Executive brief
Bootstrap is a widely-used open-source framework for building responsive web interfaces. This vulnerability allows attackers to inject malicious JavaScript code through data-* attributes (particularly data-loading-text on buttons), which executes when users interact with affected components. An attacker could exploit this to steal session cookies, redirect users to malicious sites, or deface web pages.
Technical details
This is a Stored/Reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in Bootstrap's button plugin, where the data-loading-text attribute is not properly sanitized. Malicious JavaScript injected into the data-loading-text attribute executes when the button's loading state is triggered. The vulnerability affects Bootstrap versions 1.4.0 through 3.4.1. Attack requires user interaction (clicking the button) but no authentication. An attacker can craft a web page or modify an existing page to include a button with malicious data-loading-text, and any user who triggers the loading state will execute the injected code.
Affected products
- Bootstrap Bootstrap 1.4.0 through 3.4.1
Timeline
- 2024-07-11: disclosed
- 2024-07-11: advisory: OSV and NVD publication