CVE-2018-14041: Bootstrap cross-site scripting in scrollspy data-target

CVE-2018-14041 · Severity: low · CVSS 3 · Published 2018-09-13

Bootstrap is a popular open-source HTML and CSS framework used to build responsive web applications. A cross-site scripting (XSS) vulnerability exists in the scrollspy plugin's handling of the data-target property, allowing attackers to inject malicious scripts that execute in users' browsers. This could lead to session hijacking, credential theft, or defacement of affected web pages.

Technologies: org.webjars:bootstrap (Maven), bootstrap (npm), twbs/bootstrap (Packagist). Vendors: Maven, npm, Packagist.

Quick answers

Is CVE-2018-14041 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2018-14041 being exploited in the wild.
How severe is CVE-2018-14041?
Low severity, with a CVSS score of 3, published 13 September 2018.
Which products and versions are affected?
org.webjars:bootstrap (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.1.2; bootstrap (npm) SEMVER:introduced=4.0.0,fixed=4.1.2; twbs/bootstrap (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.1.2.
Is there a fix for CVE-2018-14041?
Yes. org.webjars:bootstrap (Maven): upgrade to 4.1.2 or later; bootstrap (npm): upgrade to 4.1.2 or later; twbs/bootstrap (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-14041 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2018-14041?
Check whether you run org.webjars:bootstrap (Maven), bootstrap (npm) or twbs/bootstrap (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars:bootstrap (Maven): upgrade to 4.1.2 or later
    # set org.webjars:bootstrap to 4.1.2 in your pom.xml or build.gradle
  • bootstrap (npm): upgrade to 4.1.2 or later
    npm install bootstrap@4.1.2
  • twbs/bootstrap (Packagist): upgrade to 4.1.2 or later
    composer require twbs/bootstrap:^4.1.2

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in Bootstrap 4.0.0 through 4.1.1, specifically affecting the scrollspy JavaScript plugin's processing of the data-target attribute. The plugin fails to properly sanitize user-controlled input in this attribute, allowing attackers to inject arbitrary HTML and JavaScript code. Exploitation requires user interaction (clicking or interacting with the affected scrollspy element) and network access to a page containing the vulnerable Bootstrap version. An attacker can craft a malicious data-target value that executes arbitrary JavaScript in the victim's browser context, potentially compromising the security of the web application. The vulnerability was fixed in Bootstrap 4.1.2 and patched versions are available.

Affected products

  • Bootstrap Bootstrap 4.0.0 to 4.1.1
  • TYPO3 TYPO3 CMS 8.0.0 to 8.7.22, 9.0.0 to 9.5.3

Identifiers

  • CVE-2018-14041
  • GHSA-pj7m-g53m-7638

Timeline

  • 2018-07-13: disclosed: CVE-2018-14041 published on NVD
  • 2018-07-12: patched: Bootstrap 4.1.2 released with fix
  • 2018-09-13: advisory: GHSA-pj7m-g53m-7638 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.