Executive brief
Bootbox.js is a popular JavaScript library that simplifies creating dialog boxes and alerts in web applications. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious code through crafted payloads in alert, confirm, and prompt dialog functions, potentially compromising user sessions or stealing sensitive data.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability (CWE-79) affecting Bootbox.js versions 3.2 through 6.0. The vulnerability exists in the alert(), confirm(), and prompt() functions, which fail to properly sanitize user-supplied input before rendering it in the DOM. An attacker can craft a malicious payload and deliver it to a victim, typically via a crafted link or form submission. No authentication is required; the vulnerability requires only user interaction (clicking a link or visiting a page). An attacker can execute arbitrary JavaScript in the victim's browser context, potentially stealing cookies, session tokens, or other sensitive data. A patch is expected in a version after 6.0.
Affected products
- Bootbox Bootbox.js 3.2 through 6.0
Timeline
- 2023-11-14: disclosed
- 2018-05-24: other: Vulnerability initially reported as potential XSS issue via GitHub issue #661