Executive brief
A vulnerability in the jquery.terminal library could allow an attacker to execute malicious code in a user's browser. This library is used to create interactive command-line interfaces on websites. If exploited, an attacker could steal user session information or perform unauthorized actions on behalf of the user by tricking them into clicking a malicious link.
Technical details
Versions of jquery.terminal prior to 1.21.0 contain a reflected cross-site scripting (XSS) vulnerability. The flaw exists due to insufficient sanitization of input when the 'anyLinks' or 'invokeMethods' options are set to true. An attacker can exploit this by crafting malicious payloads that, when processed by the terminal emulator, execute arbitrary JavaScript in the context of the victim's browser session. The fix introduced in version 1.21.0 includes the 'invokeMethods' option which is now disabled by default to prevent unauthorized execution of terminal and command methods.
Affected products
- jcubic jquery.terminal < 1.21.0
Timeline
- 2018-08-25: patched: Fix committed in version 1.21.0
- 2019-05-29: disclosed: Advisory published on GitHub/NPM