Executive brief
bootstrap-table is a popular JavaScript library used to display and manage data tables in web applications. When the table export plugin is configured with htmlContent enabled, attackers who can inject content into table cells can execute arbitrary JavaScript in the browser of users exporting the table, potentially stealing session cookies, session data, or redirecting users to malicious sites.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in bootstrap-table's export plugin. The vulnerability occurs when the exportOptions setting htmlContent is set to true, causing the export function to render and evaluate HTML from table cells without proper sanitization. An attacker who can control table cell content (via data injection, API manipulation, or similar means) can inject malicious JavaScript that will execute when a user exports the table. The attack requires user interaction (the export action must be initiated) and authentication/application access to populate table data. The fix was released in version 1.20.2 and patches the onCellHtmlData function to properly sanitize content.
Affected products
- wenzhixin bootstrap-table prior to 1.20.2
Timeline
- 2022-05-17: disclosed
- 2022-05-17: patched: version 1.20.2 released