Junglewise Threat Intelligence

CVE-2018-20677: Bootstrap cross-site scripting in affix configuration

CVE-2018-20677 · Severity: low · CVSS 3 · Published 2019-01-17

Technologies: twbs/bootstrap (Packagist), bootstrap (npm), Bootstrap-Sass, org.webjars:bootstrap (Maven). Vendors: Packagist, npm, Maven.

Executive brief

Bootstrap is a widely-used front-end framework for building web applications and responsive websites. A cross-site scripting (XSS) vulnerability in the affix component's target property could allow attackers to inject malicious code that executes in users' browsers, potentially leading to session hijacking, credential theft, or defacement. This affects all versions of Bootstrap prior to 3.4.0.

Technical details

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in Bootstrap's affix component, specifically in how it handles the target configuration property. The vulnerability exists because user-supplied or untrusted input passed to the affix target property is not properly sanitized before being used in DOM manipulation operations. An attacker can craft malicious input containing JavaScript code that will be executed when the affix component processes the target property, without requiring authentication. The fix was implemented in Bootstrap 3.4.0 and later versions.

Affected products

  • Bootstrap Bootstrap before 3.4.0
  • Bootstrap bootstrap-sass before 3.4.0

Timeline

  • 2019-01-17: disclosed
  • 2018-12-13: patched: Bootstrap 3.4.0 released

References

Related threats