Junglewise Threat Intelligence

CVE-2024-6485: Bootstrap Cross-Site Scripting in data-* attributes

CVE-2024-6485 · Severity: low · CVSS 3.1 · Published 2024-07-11

Technologies: Bootstrap. Vendors: npm.

Executive brief

Bootstrap is a widely-used open-source framework for building responsive web interfaces. This vulnerability allows attackers to inject malicious JavaScript code through data-* attributes (particularly data-loading-text on buttons), which executes when users interact with affected components. An attacker could exploit this to steal session cookies, redirect users to malicious sites, or deface web pages.

Technical details

This is a Stored/Reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in Bootstrap's button plugin, where the data-loading-text attribute is not properly sanitized. Malicious JavaScript injected into the data-loading-text attribute executes when the button's loading state is triggered. The vulnerability affects Bootstrap versions 1.4.0 through 3.4.1. Attack requires user interaction (clicking the button) but no authentication. An attacker can craft a web page or modify an existing page to include a button with malicious data-loading-text, and any user who triggers the loading state will execute the injected code.

Affected products

  • Bootstrap Bootstrap 1.4.0 through 3.4.1

Timeline

  • 2024-07-11: disclosed
  • 2024-07-11: advisory: OSV and NVD publication

References

Related threats