Executive brief
Google Closure Library is a JavaScript utility library used by web applications for common programming tasks. Versions before 20190301.0.0 contain a flaw in the DOM tree sanitization function that fails to properly handle empty HTML elements, allowing attackers to inject malicious JavaScript code that executes in users' browsers.
Technical details
The vulnerability is a mutation cross-site scripting (mXSS) flaw in the safedomtreeprocessor.processToString() function. The root cause is improper handling of empty elements during sanitization, where the use of XMLSerializer to close empty elements with XML-style "/>" syntax created a bypass in browsers like Internet Explorer. An attacker can craft specially-formed HTML input that, when processed by the vulnerable function, executes arbitrary JavaScript in the context of the user's browser. The vulnerability affects all versions prior to 20190301.0.0 and can be exploited through any application that uses the affected library to sanitize user-supplied HTML. A fix is available in version 20190301.0.0 and later.
Affected products
- Google Closure Library prior to 20190301.0.0
Timeline
- 2020-09-02: disclosed: GHSA advisory published
- 2019-03-01: patched: Fix available in version 20190301.0.0