GHSA-6qqj-rx4w-r3cj CSRF Vulnerability in jquery-ujs
Attackers can leak CSRF tokens to external domains via crafted links, enabling CSRF attacks against users of the jquery-ujs library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-6qqj-rx4w-r3cj?
GHSA-6qqj-rx4w-r3cj is a vulnerability in jquery-ujs, published on 31 Aug 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains.
When an attacker controls the href attribute of an anchor tag, or the action attribute of a form tag triggering a POST action, the attacker can set the href or action to " https://attacker.com". By prepending a space to the external domain, it causes jQuery to consider it a same origin request, resulting in the user's CSRF token being sent to the external domain.
Recommendation
Upgrade jquery-ujs to version 1.0.4 or later.
Which versions are affected by GHSA-6qqj-rx4w-r3cj?
2 open source packages ship an affected version, including jquery-ujs.
| Package | Affected | Fixed in |
|---|---|---|
jquery-ujs npm | All versions | 1.0.4 |
jquery-ujs npm | All versions | 1.0.4 |
How do I fix GHSA-6qqj-rx4w-r3cj?
Upgrade jquery-ujs to 1.0.4 or later.
Is GHSA-6qqj-rx4w-r3cj being exploited?
There is no known exploitation of GHSA-6qqj-rx4w-r3cj in the wild and no public exploit code.