Quick answers
- Is CVE-2020-7656 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-7656 being exploited in the wild.
- How severe is CVE-2020-7656?
- Low severity, with a CVSS score of 3.1, published 20 May 2020.
- Which products and versions are affected?
- jQuery 1.2.1 to 1.8.3; org.webjars.npm:jquery (Maven) ECOSYSTEM:introduced=1.2.1,fixed=1.9.0; jquery-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=2.2.0.
- Is there a fix for CVE-2020-7656?
- Yes. org.webjars.npm:jquery (Maven): upgrade to 1.9.0 or later; jquery-rails (RubyGems): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-7656 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-7656?
- Check whether you run jQuery, org.webjars.npm:jquery (Maven) or jquery-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- org.webjars.npm:jquery (Maven): upgrade to 1.9.0 or later
# set org.webjars.npm:jquery to 1.9.0 in your pom.xml or build.gradle - jquery-rails (RubyGems): upgrade to 2.2.0 or later
bundle update jquery-rails
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in the jQuery load method's HTML parsing logic. The regex-based HTML detection (rquickExpr) in versions 1.2.1 through 1.8.x incorrectly recognizes strings containing script tags with trailing whitespace before the closing bracket (e.g., </script >) as non-HTML, causing them to be injected directly into the DOM without sanitization. Attack requires that an attacker can control the data source loaded by the vulnerable load() method, typically via AJAX requests to untrusted or user-controlled endpoints. An attacker can execute arbitrary JavaScript in the victim's browser context. The fix (committed in version 1.9.0) tightens the regex to require HTML strings to start immediately with a less-than sign, eliminating the bypass.
Affected products
- jQuery jQuery 1.2.1 to 1.8.3
- Rails jquery-rails 0.1.1 to 2.1.4
Identifiers
- CVE-2020-7656
- GHSA-q4m3-2j7h-f7xw
Timeline
- 2020-05-19: disclosed
- 2020-05-20: advisory