Executive brief
jquery-minicolors is a popular color-picker plugin for jQuery used in web applications. This vulnerability allows an attacker to inject malicious code into a web page viewed by users through the plugin's swatch naming functionality, potentially leading to session theft, credential capture, or malware distribution without requiring special privileges or user authentication.
Technical details
A cross-site scripting (XSS) vulnerability exists in jquery-minicolors versions up to 2.3.5 in the jquery.minicolors.js file. The vulnerability arises from unsanitized user input being directly interpolated into the DOM when rendering color swatches; specifically, the swatch name parameter was embedded in a title attribute without proper escaping. An attacker can provide a malicious swatch name containing script payloads that execute in the context of the affected web application. The attack is remotely exploitable over the network with no authentication required, though user interaction (viewing the application) is necessary. The vulnerability was patched in version 2.3.6 by removing direct string concatenation and using jQuery's .attr() method for safe attribute assignment.
Affected products
- claviska jquery-minicolors up to 2.3.5
Timeline
- 2022-12-12: disclosed: Advisory published; vulnerability previously disclosed
- 2.3.6: patched: Fixed in version 2.3.6 via commit ef134824a7f4110ada53ea6c173111a4fa2f48f3
- 2023-02-22: other: Advisory withdrawn as duplicate of GHSA-crh5-vv2v-c82q