Executive brief
jQuery, a JavaScript library used in millions of websites and content management systems like Drupal and Backdrop CMS, contains a prototype pollution vulnerability in its object extension mechanism. An attacker who can control unsanitized data processed by affected applications could inject malicious scripts that execute in users' browsers, potentially allowing account compromise or data theft.
Technical details
The vulnerability exists in jQuery versions 1.1.4 through 3.4.0 in the jQuery.extend(true, {}, ...) function. When processing unsanitized objects containing an enumerable __proto__ property, the function pollutes Object.prototype, allowing attackers to inject arbitrary properties into all JavaScript objects in the application. This prototype pollution can be leveraged to create XSS conditions. The attack requires user interaction (clicking a link containing malicious data) but no authentication. Patches are available in jQuery 3.4.1 and later; affected applications include Drupal, Backdrop CMS, Django, and various other frameworks.
Affected products
- jQuery jQuery 1.1.4 through 3.4.0
- Drupal Drupal Core affected versions (as shipped with vulnerable jQuery)
- Backdrop Project Backdrop CMS affected versions (as shipped with vulnerable jQuery)
- Django Software Foundation Django affected versions (as shipped with vulnerable jQuery)
Timeline
- 2019-04-20: disclosed: NVD published CVE-2019-11358
- 2019-04-26: disclosed: GHSA advisory published
- 2019-04-26: patched: jQuery 3.4.1 released with fix