Executive brief
Layui is a popular JavaScript UI library used to build web applications. A cross-site scripting (XSS) vulnerability in the title attribute handling of checkbox components allows attackers to inject malicious scripts that execute in users' browsers, potentially compromising user sessions, stealing data, or redirecting users to malicious sites.
Technical details
The vulnerability is a stored/reflected cross-site scripting (CWE-79) flaw in Layui's HTML Attribute Handler component. When rendering checkbox elements and other components, the title attribute parameter is not properly escaped, allowing HTML and JavaScript injection. An attacker can craft a malicious title value containing script tags or event handlers; when this is rendered on a webpage, the payload executes in the victim's browser context. The attack requires user interaction (UI:R) and network access, but no authentication. The vulnerability affects Layui versions up to v2.8.0-rc.16 and was fixed in v2.8.0 by properly escaping title attribute values.
Affected products
- Layui layui up to v2.8.0-rc.16
Timeline
- 2023-07-16: disclosed
- 2023-07-16: patched: Fix available in v2.8.0