Executive brief
CesiumJS is a popular open-source JavaScript library for creating 3D maps and globes. A demo application included with the library contains a cross-site scripting flaw that allows attackers to trick users into clicking malicious links, potentially stealing session data, credentials, or performing unauthorized actions on behalf of the user. While the issue is in example code rather than the core library, applications using this demo as a template would inherit the vulnerability.
Technical details
The vulnerability is a DOM-based XSS (CWE-79) in Apps/Sandcastle/standalone.html that arises from unsanitized use of the location.hash value when dynamically creating script tags. An attacker can craft a URL containing malicious JavaScript in the fragment identifier, which is then directly inserted into the DOM without sanitization. The attack requires user interaction (clicking a malicious link) and affects the context of a victim's browser session. The vulnerability impacts CesiumJS version 1.111 and all earlier versions. The vendor's position is that this demo code is not part of the official CesiumJS library product, though it is distributed with the repository. No public patch information is available in the advisory, though the issue may have been addressed in subsequent releases.
Affected products
- CesiumGS CesiumJS 1.111 and earlier
Timeline
- 2023-11-14: disclosed: Published on NVD and OSV
- 2023-12-19: other: Advisory withdrawn on OSV