CVE-2020-11022: jQuery XSS in DOM manipulation methods

CVE-2020-11022 · Severity: medium · CVSS 6.9 · Published 2020-04-29

jQuery is a widely used JavaScript library that helps websites display and manipulate content. A security flaw exists where the library may accidentally execute malicious code when processing web content from untrusted sources, even if that content was previously cleaned. This could allow an attacker to steal user session information or perform unauthorized actions on behalf of a visitor to a vulnerable website.

Technologies: org.webjars.npm:jquery (Maven), jquery-rails (RubyGems). Vendors: Maven, Packagist, RubyGems.

Quick answers

Is CVE-2020-11022 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-11022 being exploited in the wild.
How severe is CVE-2020-11022?
Medium severity, with a CVSS score of 6.9, published 29 April 2020.
Which products and versions are affected?
org.webjars.npm:jquery (Maven) >= 1.12.0, < 3.5.0, ECOSYSTEM:introduced=1.12.0,fixed=3.5.0; Maxime Bouroumeau-Fuseau Debugbar < 1.19.0; athlon1600/youtube-downloader (Packagist) <= 4.0.0; components/jquery (Packagist) >= 1.12.0, < 3.5.0; and 2 more.
Is there a fix for CVE-2020-11022?
Yes. org.webjars.npm:jquery (Maven): upgrade to 3.5.0 or later; jquery-rails (RubyGems): upgrade to 4.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-11022 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-11022?
Check whether you run org.webjars.npm:jquery (Maven), Maxime Bouroumeau-Fuseau Debugbar, athlon1600/youtube-downloader (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars.npm:jquery (Maven): upgrade to 3.5.0 or later
    # set org.webjars.npm:jquery to 3.5.0 in your pom.xml or build.gradle
  • jquery-rails (RubyGems): upgrade to 4.4.0 or later
    bundle update jquery-rails

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in jQuery's DOM manipulation methods, such as .html() and .append(). The issue stems from how jQuery handles HTML strings containing certain tags, which can bypass sanitization logic when processed through jQuery's internal pre-filtering mechanisms. An attacker can exploit this by providing specially crafted HTML that, when passed to these methods, executes arbitrary JavaScript in the context of the victim's browser. This vulnerability is tracked as CVE-2020-11022 and is resolved in jQuery version 3.5.0. A workaround is available for older versions (1.12/2.2+) by overriding jQuery.htmlPrefilter to return the input unchanged.

Affected products

  • jquery jquery >= 1.12.0, < 3.5.0
  • rubysec jquery-rails < 4.4.0
  • maximebf debugbar < 1.19.0

Identifiers

  • CVE-2020-11022
  • GHSA-gxr4-xjj5-5px2

Timeline

  • 2020-04-10: patched: jQuery 3.5.0 released
  • 2020-04-29: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.