Executive brief
AWS UI components-react is a React component library used by AWS web applications to build user interfaces. The library failed to properly neutralize user-supplied content before rendering it, allowing attackers to inject malicious scripts that execute in users' browsers. This could lead to theft of session credentials, website defacement, or malware distribution through a single compromised application.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) in multiple components of @awsui/components-react, where user-controllable input is rendered without adequate HTML/JavaScript neutralization. The attack requires user interaction (e.g., clicking a malicious link) and is network-accessible with no privileges required. An attacker can inject arbitrary JavaScript code that executes in the browser context of any user interacting with a vulnerable application using this library. The vulnerability has been patched in version 3.0.367 and affects all versions prior to that release.
Affected products
- AWS components-react before 3.0.367
Timeline
- 2022-02-24: disclosed
- 2022-02-24: patched: Fixed in version 3.0.367