GHSA-fj93-7wm4-8x2g Cross-Site Scripting in jquery-mobile
Attackers can execute arbitrary JavaScript via reflected XSS in jQuery Mobile by manipulating location hash and unvalidated XHR responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is GHSA-fj93-7wm4-8x2g?
GHSA-fj93-7wm4-8x2g is a cross-site scripting vulnerability in jquery-mobile, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All version of jquery-mobile are vulnerable to Cross-Site Scripting. The package checks for content in location.hash and if a URL is found it does an XmlHttpRequest (XHR) to the URL and renders the response with innerHTML. It fails to validate the Content-Type of the response, allowing attackers to include malicious payloads as part of query parameters that are reflected back to the user. A response such as {"q":"<iframe/src='javascript:alert(1)'></iframe>","results":[]} would be parsed as HTML and the JavaScript payload executed.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Which versions are affected by GHSA-fj93-7wm4-8x2g?
2 open source packages ship an affected version, including jquery-mobile.
| Package | Affected | Fixed in |
|---|---|---|
jquery-mobile npm | All versions | None |
jquery-mobile npm | All versions | None |
How do I fix GHSA-fj93-7wm4-8x2g?
No fix has been published for GHSA-fj93-7wm4-8x2g yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-fj93-7wm4-8x2g being exploited?
There is no known exploitation of GHSA-fj93-7wm4-8x2g in the wild and no public exploit code.