Junglewise Threat Intelligence

CVE-2020-7691: Parallax jsPDF cross-site scripting via regex bypass

CVE-2020-7691 · Severity: low · CVSS 3.1 · Published 2021-05-11

Technologies: jspdf (npm). Vendors: Parallax, npm.

Executive brief

jsPDF is a popular JavaScript library used by developers to generate PDF documents directly in web browsers. A security flaw allows attackers to bypass safety filters and execute malicious scripts when the library processes specially crafted HTML content. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or redirecting users to malicious websites.

Technical details

A cross-site scripting (XSS) vulnerability exists in jsPDF due to an inadequate regular expression used for sanitizing HTML input, specifically within the fromHTML functionality. Attackers can bypass the filter by using nested or malformed script tags (e.g., <<script>script>). When the library processes this input, the outer tags are stripped but the inner malicious script remains and is executed in the context of the user's browser. This is a client-side XSS that requires user interaction, such as viewing a page that triggers the PDF generation from untrusted input. The issue was addressed by updating the underlying DOMPurify dependency to version 2.2.0 or higher.

Affected products

  • Parallax jspdf < 2.0.0

Timeline

  • 2020-05-06: disclosed: Vulnerability disclosed by Snyk Security Team
  • 2020-07-06: advisory: NVD published CVE-2020-7691
  • 2021-05-11: advisory: GitHub Advisory published

References

Related threats