Executive brief
react-dom is a JavaScript library used by web developers to build interactive user interfaces, particularly on the server side. A flaw in how the library handles HTML attribute names allows attackers to inject malicious JavaScript code when an application accepts user input for attribute names and renders it server-side, potentially compromising user sessions or stealing sensitive data from visitors' browsers.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) in react-dom's server-side rendering (ReactDOMServer) caused by insufficient validation of HTML attribute names. When an application passes unsanitized user input as attribute names in HTML tags during server rendering, an attacker can inject malicious attribute names containing JavaScript (e.g., event handlers). The attack requires three preconditions: server-side React rendering, use of ReactDOMServer, and inclusion of user-controlled attribute names. An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser context with changed scope (affecting resources beyond the vulnerable component). Patches are available: upgrade to react-dom 16.0.1, 16.1.2, 16.2.1, 16.3.3, or 16.4.2 depending on the major version in use.
Affected products
- Facebook react-dom 16.0.0, 16.1.0 to <16.1.2, 16.2.0, 16.3.0 to <16.3.3, 16.4.0 to <16.4.2
Timeline
- 2019-01-04: disclosed
- 2018-08-01: patched: Patches released for versions 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2