Junglewise Threat Intelligence

CVE-2018-20676: twbs Bootstrap XSS in tooltip data-viewport attribute

CVE-2018-20676 · Severity: low · CVSS 3 · Published 2019-01-17

Technologies: Twbs Bootstrap, twbs/bootstrap (Packagist), org.webjars:bootstrap (Maven), bootstrap-sass (npm). Vendors: Packagist, npm, Maven.

Executive brief

Bootstrap, a widely used web development framework, contains a security flaw in how it handles tooltips. An attacker could use this to run malicious scripts in a user's browser if they interact with a specially crafted part of a website. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Bootstrap versions prior to 3.4.0. The flaw is located in the tooltip component's handling of the 'data-viewport' attribute, which fails to properly sanitize input before rendering it in the DOM. An attacker can exploit this by injecting a malicious script into the attribute (e.g., via an <img> tag with an 'onerror' handler). Execution occurs when a user interacts with the affected element, such as hovering over a link that triggers the tooltip. This is a client-side vulnerability requiring user interaction. The issue was resolved in version 3.4.0 by implementing proper input neutralization.

Affected products

  • twbs bootstrap < 3.4.0
  • twbs bootstrap-sass < 3.4.0

Timeline

  • 2018-08-10: disclosed: Issue reported on GitHub repository
  • 2018-12-13: patched: Bootstrap 3.4.0 released with fix
  • 2019-01-17: advisory: GitHub advisory published

References

Related threats