Is CVE-2019-10785 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-10785 being exploited in the wild.

How severe is CVE-2019-10785?

Low severity, with a CVSS score of 3.1, published 13 February 2020.

Which products and versions are affected?

dojox (npm) SEMVER:introduced=0,fixed=1.11.9.

Is there a fix for CVE-2019-10785?

Yes. dojox (npm): upgrade to 1.11.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-10785 attacked?

It is attacked over the network.

Am I affected by CVE-2019-10785?

Check whether you run dojox (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-10785: Dojo dojox cross-site scripting in xmlEncode

CVE-2019-10785 · Severity: low · CVSS 3.1 · Published 2020-02-13

DojoX is a JavaScript library providing extensions to the Dojo Toolkit, widely used in web applications for XMPP messaging and template rendering. A cross-site scripting (XSS) vulnerability in the xmlEncode function allows attackers to inject malicious scripts through insufficiently escaped XML content, potentially compromising user sessions, stealing credentials, or defacing web pages.

Technologies: dojox (npm). Vendors: npm.

Quick answers

Is CVE-2019-10785 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-10785 being exploited in the wild.
How severe is CVE-2019-10785?: Low severity, with a CVSS score of 3.1, published 13 February 2020.
Which products and versions are affected?: dojox (npm) SEMVER:introduced=0,fixed=1.11.9.
Is there a fix for CVE-2019-10785?: Yes. dojox (npm): upgrade to 1.11.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-10785 attacked?: It is attacked over the network.
Am I affected by CVE-2019-10785?: Check whether you run dojox (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dojox (npm): upgrade to 1.11.9 or later
```
npm install dojox@1.11.9
```

Technical details

The vulnerability exists in dojox.xmpp.util.xmlEncode due to incomplete XML entity escaping. The function applies escape replacements in the wrong order—it escapes ampersands first, then quotes and angle brackets—which causes previously-escaped content to be re-escaped and allows bypass of the escaping mechanism. An attacker can craft specially-formed XML input with unescaped angle brackets or quotes that bypasses the intended protection. The vulnerability affects users of dojox/xmpp and dojox/dtl components. Patches are available for versions 1.11.9 through 1.16.1, and users of earlier versions should backport the fix from pull request #315.

Affected products

Dojo dojox before 1.11.9; 1.12.0–1.12.6; 1.13.0–1.13.5; 1.14.0–1.14.4; 1.15.0–1.15.1; 1.16.0

Identifiers

CVE-2019-10785
GHSA-pg97-ww7h-5mjr

Timeline

2020-02-13: disclosed
2020-02-13: patched: Patches available for versions 1.11.9, 1.12.7, 1.13.6, 1.14.5, 1.15.2, 1.16.1

References

https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.