Executive brief
Bootstrap, a popular web development framework, is vulnerable to a security flaw that could allow attackers to execute malicious code in a user's browser. This occurs when the framework's tooltip or popover components are used to display unsanitized content. An exploit could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Bootstrap versions prior to 3.4.1 and 4.3.1. The root cause is the lack of proper input sanitization in the 'data-template' attribute used by the tooltip and popover plugins. A remote attacker can exploit this by injecting malicious JavaScript into this attribute, which is then executed in the context of the victim's browser session when the component is rendered. This is a client-side vulnerability requiring user interaction. Patches are available in versions 3.4.1 and 4.3.1.
Affected products
- Bootstrap bootstrap >= 3.0.0, < 3.4.1; >= 4.0.0, < 4.3.1
- Bootstrap bootstrap-sass >= 3.0.0, < 3.4.1
- Bootstrap twitter-bootstrap-rails < 5.3.0
Timeline
- 2019-02-20: disclosed
- 2019-02-22: advisory