CVE-2019-11358: PYSEC-2026-628 - XSS in jQuery as used in Drupal, Backdrop CMS, and other products

CVE-2019-11358 · Severity: low · CVSS 3.1 · Published 2019-04-17

jQuery, a JavaScript library used in millions of websites and content management systems like Drupal and Backdrop CMS, contains a prototype pollution vulnerability in its object extension mechanism. An attacker who can control unsanitized data processed by affected applications could inject malicious scripts that execute in users' browsers, potentially allowing account compromise or data theft.

Technologies: Drupal Core, jQuery, org.webjars.npm:jquery (Maven), drupal/core (Packagist), Django (PyPI), jquery-rails (RubyGems). Vendors: Drupal, jQuery, Maven, Packagist, PyPI, RubyGems.

Quick answers

Is CVE-2019-11358 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-11358 being exploited in the wild.
How severe is CVE-2019-11358?
Low severity, with a CVSS score of 3.1, published 17 April 2019.
Which products and versions are affected?
Backdrop Project Backdrop CMS affected versions (as shipped with vulnerable jQuery); Drupal Core affected versions (as shipped with vulnerable jQuery); jQuery 1.1.4 through 3.4.0; org.webjars.npm:jquery (Maven) ECOSYSTEM:introduced=1.1.4,fixed=3.4.0; and 3 more.
Is there a fix for CVE-2019-11358?
Yes. org.webjars.npm:jquery (Maven): upgrade to 3.4.0 or later; drupal/core (Packagist): upgrade to 8.5.15 or later; Django (PyPI): upgrade to 2.2.2 or later; jquery-rails (RubyGems): upgrade to 4.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-11358 attacked?
It is attacked over the network.
Am I affected by CVE-2019-11358?
Check whether you run Backdrop Project Backdrop CMS, Drupal Core, jQuery or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars.npm:jquery (Maven): upgrade to 3.4.0 or later
    # set org.webjars.npm:jquery to 3.4.0 in your pom.xml or build.gradle
  • drupal/core (Packagist): upgrade to 8.5.15 or later
    composer require drupal/core:^8.5.15
  • Django (PyPI): upgrade to 2.2.2 or later
    pip install "Django>=2.2.2"
  • jquery-rails (RubyGems): upgrade to 4.3.4 or later
    bundle update jquery-rails

Technical details

The vulnerability exists in jQuery versions 1.1.4 through 3.4.0 in the jQuery.extend(true, {}, ...) function. When processing unsanitized objects containing an enumerable __proto__ property, the function pollutes Object.prototype, allowing attackers to inject arbitrary properties into all JavaScript objects in the application. This prototype pollution can be leveraged to create XSS conditions. The attack requires user interaction (clicking a link containing malicious data) but no authentication. Patches are available in jQuery 3.4.1 and later; affected applications include Drupal, Backdrop CMS, Django, and various other frameworks.

Affected products

  • jQuery jQuery 1.1.4 through 3.4.0
  • Drupal Drupal Core affected versions (as shipped with vulnerable jQuery)
  • Backdrop Project Backdrop CMS affected versions (as shipped with vulnerable jQuery)
  • Django Software Foundation Django affected versions (as shipped with vulnerable jQuery)

Identifiers

  • CVE-2019-11358
  • DRUPAL-CORE-2019-006
  • GHSA-6c3j-c64m-qhgq
  • PYSEC-2026-628

Timeline

  • 2019-04-20: disclosed: NVD published CVE-2019-11358
  • 2019-04-26: disclosed: GHSA advisory published
  • 2019-04-26: patched: jQuery 3.4.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.