Executive brief
Knockout is a JavaScript library used to build interactive web applications with dynamic data binding. A cross-site scripting (XSS) vulnerability exists in how the library handles the "name" attribute binding, particularly on older Internet Explorer browsers. An attacker who can control data bound to an element's name attribute could inject malicious JavaScript code that executes in users' browsers, potentially stealing credentials, session tokens, or performing actions on behalf of the victim.
Technical details
The vulnerability is a stored/reflected XSS flaw (CWE-79) in Knockout's attr binding handler, specifically in the setElementName utility function. When binding data to an HTML element's "name" attribute, the library passes user-controlled input directly into DOM string concatenation without sanitization, particularly in IE 6/7 where it uses mergeAttributes() to work around an IE bug. An attacker can inject arbitrary JavaScript by crafting malicious values in the data bound to the name attribute. The vulnerability is network-reachable and only requires user interaction (rendering the page with malicious data). It was fixed in Knockout version 3.5.0.
Affected products
- Knockout Knockout before 3.5.0
Timeline
- 2013-12-10: disclosed: Issue reported on GitHub
- 2015: patched: Fixed in version 3.5.0
- 2020-04-01: advisory: GHSA published
- 2020-01-02: other: NVD published