Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 25 August 2020.

Which products and versions are affected?

highcharts (npm) SEMVER:introduced=0,fixed=7.2.2.

Is there a fix for This vulnerability?

Yes. highcharts (npm): upgrade to 7.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Highcharts cross-site scripting in href sanitization

Severity: low · CVSS 3.1 · Published 2020-08-25

Highcharts is a popular JavaScript charting library used to create interactive data visualizations on websites. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into charts if unsanitized user input (such as chart titles, labels, or links) is used in chart configuration. An attacker could craft a malicious link that, when clicked by a user viewing a chart, executes arbitrary JavaScript in their browser, potentially stealing session data, account credentials, or other sensitive information.

Technologies: highcharts (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 25 August 2020.
Which products and versions are affected?: highcharts (npm) SEMVER:introduced=0,fixed=7.2.2.
Is there a fix for This vulnerability?: Yes. highcharts (npm): upgrade to 7.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

highcharts (npm): upgrade to 7.2.2 or later
```
npm install highcharts@7.2.2
```

Technical details

The vulnerability is a stored/reflected XSS (CWE-79) in Highcharts' handling of `<a>` tags within chart configuration. The library fails to properly sanitize href attributes and does not restrict URL schemes, converting `<a>` tags to `<tspan>` elements with onclick handlers. An attacker can inject arbitrary JavaScript URLs (using javascript: scheme or event handlers) through chart configuration properties such as titles, subtitles, labels, or tooltips. The vulnerability affects versions prior to 7.2.2 and 8.0.0–8.1.0. The root cause is insufficient input validation on URLs and attributes during DOM rendering. The vulnerability has been fixed in versions 7.2.2 and 8.1.1 via commit 55c39dd, which properly sanitizes URL schemes and href values.

Affected products

Highcharts Highcharts before 7.2.2, 8.0.0 to before 8.1.1

Timeline

2020-05-20: disclosed: Vulnerability reported on GitHub issue #13559
2020-05-20: patched: Fix committed (55c39dd) same day
2020-08-25: advisory: GHSA-gr4j-r575-g665 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.