Junglewise Threat Intelligence

CVE-2021-41184: jQuery UI XSS in position() method

CVE-2021-41184 · Severity: low · CVSS 3.1 · Published 2021-10-26

Technologies: jQuery.UI.Combined (NuGet), jQuery Foundation Jquery-Ui, org.webjars.npm:jquery-ui (Maven), jquery-ui-rails (RubyGems). Vendors: NuGet, npm, Maven, RubyGems.

Executive brief

jQuery UI is a popular JavaScript library providing interactive widgets and utilities for web applications. A cross-site scripting (XSS) vulnerability in the `.position()` utility function allows arbitrary JavaScript code execution when the `of` parameter accepts untrusted input, potentially compromising user sessions, stealing sensitive data, or performing unauthorized actions on behalf of affected users.

Technical details

The vulnerability is a DOM-based cross-site scripting (XSS) flaw in the `.position()` utility function of jQuery UI. The root cause is that string values passed to the `of` option were not properly sanitized, allowing attackers to inject malicious HTML/JavaScript. An attacker can craft a malicious string containing HTML tags with event handlers (e.g., `<img onerror='doEvilThing()' />`) and supply it as the `of` parameter; when processed, the injected code executes in the user's browser context. The vulnerability requires the application to accept user-controlled input for the `of` parameter. The fix, released in jQuery UI 1.13.0, treats all string values passed to `of` as CSS selectors, preventing HTML injection.

Affected products

  • jQuery Foundation jQuery UI before 1.13.0

Timeline

  • 2021-10-25: disclosed: Advisory published
  • 2021-10-26: patched: jQuery UI 1.13.0 released with fix

References

Related threats