Executive brief
Materialize-css is a popular CSS framework providing UI components for web applications. The autocomplete component fails to sanitize user input, allowing attackers to inject and execute malicious JavaScript code when data is rendered in the browser. This can lead to credential theft, session hijacking, or data exfiltration affecting any website using affected versions of the library.
Technical details
The vulnerability is a Stored or Reflected Cross-Site Scripting (XSS, CWE-79) flaw in the autocomplete component. The root cause is insufficient input sanitization: the component uses innerHTML or .html() jQuery methods to render user-supplied data directly into the DOM without escaping HTML/JavaScript. An attacker can inject arbitrary HTML and JavaScript through autocomplete data options. The attack requires that malicious input be included in the autocomplete dataset and rendered by a user—no prior authentication is required. A successful exploit allows arbitrary JavaScript execution in the victim's browser context, compromising the security of the entire web application. No fix was available at the time of publication; the @materializecss/materialize fork received a fix in version 1.1.0-alpha, but the original materialize-css package (up to version 1.0.0) remains unpatched.
Affected products
- Materialize materialize-css all versions up to and including 1.0.0
- Materialize materialize all versions up to 1.0.0 (original package)
Timeline
- 2019-02-08: disclosed: Security issue reported on GitHub
- 2019-04-09: advisory: GHSA-7752-f4gf-94gc advisory published