CVE-2019-11003: Materialize-css Cross-site Scripting in autocomplete component

CVE-2019-11003 · Severity: low · CVSS 3 · Published 2019-04-09

Materialize-css is a popular CSS framework providing UI components for web applications. The autocomplete component fails to sanitize user input, allowing attackers to inject and execute malicious JavaScript code when data is rendered in the browser. This can lead to credential theft, session hijacking, or data exfiltration affecting any website using affected versions of the library.

Technologies: @materializecss/materialize (npm), materialize-css (npm). Vendors: npm.

Quick answers

Is CVE-2019-11003 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-11003 being exploited in the wild.
How severe is CVE-2019-11003?
Low severity, with a CVSS score of 3, published 9 April 2019.
Which products and versions are affected?
Materialize all versions up to 1.0.0 (original package); @materializecss/materialize (npm) SEMVER:introduced=0,fixed=1.1.0-alpha; materialize-css (npm) SEMVER:introduced=0,last_affected=1.0.0.
Is there a fix for CVE-2019-11003?
Yes. @materializecss/materialize (npm): upgrade to 1.1.0-alpha or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-11003 attacked?
It is attacked over the network.
Am I affected by CVE-2019-11003?
Check whether you run Materialize, @materializecss/materialize (npm) or materialize-css (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @materializecss/materialize (npm): upgrade to 1.1.0-alpha or later
    npm install @materializecss/materialize@1.1.0-alpha

Technical details

The vulnerability is a Stored or Reflected Cross-Site Scripting (XSS, CWE-79) flaw in the autocomplete component. The root cause is insufficient input sanitization: the component uses innerHTML or .html() jQuery methods to render user-supplied data directly into the DOM without escaping HTML/JavaScript. An attacker can inject arbitrary HTML and JavaScript through autocomplete data options. The attack requires that malicious input be included in the autocomplete dataset and rendered by a user—no prior authentication is required. A successful exploit allows arbitrary JavaScript execution in the victim's browser context, compromising the security of the entire web application. No fix was available at the time of publication; the @materializecss/materialize fork received a fix in version 1.1.0-alpha, but the original materialize-css package (up to version 1.0.0) remains unpatched.

Affected products

  • Materialize materialize-css all versions up to and including 1.0.0
  • Materialize materialize all versions up to 1.0.0 (original package)

Identifiers

  • CVE-2019-11003
  • GHSA-7752-f4gf-94gc

Timeline

  • 2019-02-08: disclosed: Security issue reported on GitHub
  • 2019-04-09: advisory: GHSA-7752-f4gf-94gc advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.