CVE-2022-31160: jQuery UI XSS in checkboxradio refresh with HTML-like label text

CVE-2022-31160 · Severity: low · CVSS 3.1 · Published 2022-07-18

jQuery UI is a popular JavaScript library that provides interactive user interface components for web applications. A vulnerability in its checkboxradio widget allows attackers to execute arbitrary JavaScript code if the widget is refreshed while containing encoded HTML entities in label text. This could enable account takeover, session hijacking, or malware injection in affected web applications.

Technologies: org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet), jquery-ui-rails (RubyGems). Vendors: Maven, npm, NuGet, RubyGems.

Quick answers

Is CVE-2022-31160 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-31160 being exploited in the wild.
How severe is CVE-2022-31160?
Low severity, with a CVSS score of 3.1, published 18 July 2022.
Which products and versions are affected?
org.webjars.npm:jquery-ui (Maven) ECOSYSTEM:introduced=0,fixed=1.13.2; jquery-ui (npm) SEMVER:introduced=0,fixed=1.13.2; jQuery.UI.Combined (NuGet) ECOSYSTEM:introduced=0,fixed=1.13.2; jquery-ui-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=8.0.0.
Is there a fix for CVE-2022-31160?
Yes. org.webjars.npm:jquery-ui (Maven): upgrade to 1.13.2 or later; jquery-ui (npm): upgrade to 1.13.2 or later; jQuery.UI.Combined (NuGet): upgrade to 1.13.2 or later; jquery-ui-rails (RubyGems): upgrade to 8.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-31160 attacked?
It is attacked over the network.
Am I affected by CVE-2022-31160?
Check whether you run org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars.npm:jquery-ui (Maven): upgrade to 1.13.2 or later
    # set org.webjars.npm:jquery-ui to 1.13.2 in your pom.xml or build.gradle
  • jquery-ui (npm): upgrade to 1.13.2 or later
    npm install jquery-ui@1.13.2
  • jQuery.UI.Combined (NuGet): upgrade to 1.13.2 or later
    dotnet add package jQuery.UI.Combined --version 1.13.2
  • jquery-ui-rails (RubyGems): upgrade to 8.0.0 or later
    bundle update jquery-ui-rails

Technical details

The vulnerability is a stored/reflected cross-site scripting (XSS) flaw in jQuery UI's checkboxradio widget. When a checkboxradio widget is initialized on an input element within a label, and then refreshed via the .checkboxradio("refresh") method, HTML-encoded entities in the label text are improperly decoded and inserted into the DOM without sanitization. This occurs because the widget extracts label contents and processes them through text manipulation that converts HTML entities (e.g., < to <) before rendering. An attacker who can control the initial HTML structure can inject malicious event handlers (e.g., onerror attributes) that execute arbitrary JavaScript when the page loads or the widget refreshes. The attack requires no authentication and only user interaction to load the affected page. The vulnerability has been patched in jQuery UI version 1.13.2 and later.

Affected products

  • jQuery UI before 1.13.2

Identifiers

  • CVE-2022-31160
  • GHSA-h6gj-6jjq-h8g9

Timeline

  • 2022-07-15: disclosed: Advisory published
  • 2022-07-18: patched: jQuery UI 1.13.2 released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.