Executive brief
Bootstrap is a widely-used front-end framework for building web applications and responsive websites. A cross-site scripting (XSS) vulnerability in the affix component's target property could allow attackers to inject malicious code that executes in users' browsers, potentially leading to session hijacking, credential theft, or defacement. This affects all versions of Bootstrap prior to 3.4.0.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in Bootstrap's affix component, specifically in how it handles the target configuration property. The vulnerability exists because user-supplied or untrusted input passed to the affix target property is not properly sanitized before being used in DOM manipulation operations. An attacker can craft malicious input containing JavaScript code that will be executed when the affix component processes the target property, without requiring authentication. The fix was implemented in Bootstrap 3.4.0 and later versions.
Affected products
- Bootstrap Bootstrap before 3.4.0
- Bootstrap bootstrap-sass before 3.4.0
Timeline
- 2019-01-17: disclosed
- 2018-12-13: patched: Bootstrap 3.4.0 released