Executive brief
Ionic Core is a UI toolkit used to build mobile and web applications. Multiple components in the library fail to sanitize user-supplied text before displaying it on the page, allowing attackers to inject malicious JavaScript code that executes in users' browsers. This could enable attackers to steal session data, redirect users, or perform actions on their behalf.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw affecting multiple Ionic Core components (ion-alert, ion-searchbar, ion-infinite-scroll-content, ion-refresher-content) that use the unsafe innerHTML function without proper input sanitization. An attacker can inject arbitrary JavaScript through component properties such as message, placeholder, loadingText, pullingText, and refreshingText. No special privileges or network access beyond the application itself is required; the attack is triggered whenever a user loads or interacts with a page containing one of the affected components with malicious input. Patches are available in versions 4.0.3, 4.1.3, 4.2.1, and 4.3.1 depending on the minor version line in use.
Affected products
- Ionic @ionic/core before 4.0.3; 4.1.0 before 4.1.3; 4.2.0 before 4.2.1; 4.3.0 before 4.3.1
Timeline
- 2020-09-03: disclosed