Executive brief
ids-enterprise is a JavaScript component library used to build enterprise web applications. A Cross-Site Scripting (XSS) vulnerability in the soho-autocomplete component allows attackers to inject and execute malicious JavaScript in users' browsers, potentially enabling account takeover, session hijacking, or data theft from application users.
Technical details
The vulnerability is a reflected/stored Cross-Site Scripting (CWE-79) in the soho-autocomplete component of ids-enterprise versions prior to 4.18.2. Script tags are not properly encoded or sanitized in the autocomplete input handling, allowing attackers to break out of the data context and execute arbitrary JavaScript. The attack requires user interaction (e.g., viewing a malicious autocomplete suggestion) but does not require authentication. An attacker can exploit this to steal session cookies, perform actions on behalf of the user, or harvest sensitive data. The vulnerability is fixed in version 4.18.2 and later.
Affected products
- IDS ids-enterprise < 4.18.2
Timeline
- 2019-06-13: disclosed
- 2019-06-13: patched: Fix available in version 4.18.2