Executive brief
react-bootstrap-table is a library used to build interactive data tables in web applications. A security flaw allows attackers to inject malicious scripts into these tables if the application displays untrusted data. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or redirecting users to malicious websites.
Technical details
All versions of react-bootstrap-table (up to 4.3.1) are vulnerable to Cross-Site Scripting (XSS) via the dataFormat parameter in TableHeaderColumn. The vulnerability occurs when the dataFormat function returns a value that is not a valid React element, causing the library to fallback to using dangerouslySetInnerHTML without proper sanitization. An attacker can exploit this by providing malicious HTML/JavaScript strings in the data source. If the application renders this data using a simple pass-through dataFormat function, the script will execute in the context of the victim's browser. As of the advisory date, no official patch has been released, and the library is considered deprecated in favor of react-bootstrap-table2.
Affected products
- AllenFang react-bootstrap-table <= 4.3.1
Timeline
- 2019-04-18: disclosed: Issue first reported on GitHub
- 2021-06-24: advisory: NVD and Snyk published advisories
- 2021-12-10: advisory: GitHub Advisory published