Executive brief
DojoX is a JavaScript library providing extensions to the Dojo Toolkit, widely used in web applications for XMPP messaging and template rendering. A cross-site scripting (XSS) vulnerability in the xmlEncode function allows attackers to inject malicious scripts through insufficiently escaped XML content, potentially compromising user sessions, stealing credentials, or defacing web pages.
Technical details
The vulnerability exists in dojox.xmpp.util.xmlEncode due to incomplete XML entity escaping. The function applies escape replacements in the wrong order—it escapes ampersands first, then quotes and angle brackets—which causes previously-escaped content to be re-escaped and allows bypass of the escaping mechanism. An attacker can craft specially-formed XML input with unescaped angle brackets or quotes that bypasses the intended protection. The vulnerability affects users of dojox/xmpp and dojox/dtl components. Patches are available for versions 1.11.9 through 1.16.1, and users of earlier versions should backport the fix from pull request #315.
Affected products
- Dojo dojox before 1.11.9; 1.12.0–1.12.6; 1.13.0–1.13.5; 1.14.0–1.14.4; 1.15.0–1.15.1; 1.16.0
Timeline
- 2020-02-13: disclosed
- 2020-02-13: patched: Patches available for versions 1.11.9, 1.12.7, 1.13.6, 1.14.5, 1.15.2, 1.16.1