Executive brief
Materialize-css is a popular front-end framework used to build responsive web interfaces. The tooltip component fails to sanitize user input, allowing attackers to inject and execute arbitrary JavaScript code in users' browsers. This could lead to session hijacking, credential theft, or malware distribution if an application displays untrusted data in tooltips.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the tooltip component caused by insufficient input sanitization. The component uses innerHTML or jQuery's .html() method to render user-supplied data directly as HTML without stripping JavaScript payloads, allowing an attacker to inject malicious code via tooltip attributes or dynamic content. The attack requires user interaction (hovering over or rendering a tooltip containing the malicious payload) and can be triggered if an application passes untrusted data (such as user input or unsanitized server responses) to the tooltip. No fix was initially available for affected versions up to 1.0.0, though later versions may address this issue.
Affected products
- Materialize materialize-css all versions up to 1.0.0
- Materialize @materializecss/materialize all versions prior to 1.1.0-alpha
Timeline
- 2019-02-08: disclosed: Security issue reported on GitHub
- 2019-04-09: advisory: GHSA-98f7-p5rc-jx67 published
- 2019-04-09: other: CVE-2019-11002 assigned