Executive brief
jSuites is a popular JavaScript library providing spreadsheet and editor functionality for web applications. Versions prior to 5.0.1 contain a cross-site scripting (XSS) vulnerability in the Editor function that allows attackers to inject malicious scripts when users paste or input content. An attacker can exploit this to steal user sessions, credentials, or perform actions on behalf of affected users.
Technical details
The vulnerability is a stored/reflected cross-site scripting (XSS) vulnerability (CWE-79) in the Editor() function of jSuites caused by improper sanitization of user input. The attack vector is network-based with user interaction required (copy/paste action). No authentication is needed to trigger the vulnerability. An attacker can inject arbitrary JavaScript code through malformed input, which will execute in the context of the affected application. The vulnerability affects all versions prior to 5.0.1, which introduces proper input sanitization.
Affected products
- jSuites jSuites < 5.0.1
Timeline
- 2023-01-31: disclosed
- 2023-01-31: patched: Fixed in version 5.0.1