Executive brief
jquery.terminal is a JavaScript library that provides a web-based terminal interface. This vulnerability allows stored cross-site scripting (XSS) attacks through user input, though with limited scope since malicious code must be entered directly into the terminal and remains visible. An attacker could exploit this if an application uses the execHash option to run code from URLs, potentially executing arbitrary scripts in the context of users' browsers.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw caused by improper sanitization of user input in HTML attributes within span tags. The attack requires direct user input or manipulation of URL parameters when execHash is enabled, and the malicious payload is visible in the terminal, making it a "self XSS" variant. The impact is limited because automatic script execution (like onerror on image tags) is not possible due to the HTML attribute injection context. The vulnerability was fixed in version 2.31.1, and users can implement a workaround using formatters to wrap user input.
Affected products
- jcubic jquery.terminal before 2.31.1
Timeline
- 2021-12-30: disclosed
- 2022-01-06: advisory
- 2022-01-06: patched: Fixed in version 2.31.1