Executive brief
diagram-js is a JavaScript library used for creating and visualizing diagrams and business process models. The search-pad feature fails to properly escape user-supplied input, allowing attackers to inject arbitrary JavaScript code that runs in the browsers of users viewing the diagram. This can lead to session hijacking, credential theft, or malware delivery.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw in the search-pad component of diagram-js. The library fails to escape HTML/JavaScript in user-controlled input (title and search text) before rendering it in the DOM, allowing attackers to inject malicious scripts. The vulnerability affects versions prior to 2.6.2 (in the 2.x branch) and 3.3.1 (in the 3.x branch). The attack requires user interaction—specifically, a user must view a diagram containing the malicious input in the search-pad. The fix involves applying HTML escaping to user-supplied search and title strings using an EscapeUtil function before DOM insertion.
Affected products
- bpmn-io diagram-js < 2.6.2 and 3.0.0 <= version < 3.3.1
Timeline
- 2020-09-11: disclosed
- 2020: patched: Fixed in 2.6.2 and 3.3.1