Executive brief
Semantic UI Search is a popular JavaScript UI component framework used to build interactive web interfaces. A cross-site scripting (XSS) vulnerability in the dropdown selection feature allows attackers to inject malicious scripts through user input fields, which are then executed in the browser instead of being safely displayed as text. This could enable attackers to steal user credentials, hijack sessions, or redirect users to malicious sites.
Technical details
The vulnerability is a stored/reflected cross-site scripting (CWE-79) affecting all versions of semantic-ui-search. The root cause is insufficient output encoding in the dropdown selection component, specifically in the tagging and user additions input feature. An attacker can inject script tags (e.g., <script>alert(10);</script>) through the dropdown's input fields, and the component will execute the script in the user's browser rather than escaping and displaying it as text. The attack requires user interaction (entering malicious input in the dropdown), but no authentication is required. No patch has been made available as of the advisory publication date.
Affected products
- Semantic-Org Semantic UI Search all versions
Timeline
- 2016-08-29: disclosed
- 2020-09-02: advisory