GHSA-v73w-r9xg-7cr9 Use of insecure jQuery version in OctoberCMS
Attackers can execute arbitrary JavaScript in victim browsers via insecure jQuery DOM manipulation methods in OctoberCMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-v73w-r9xg-7cr9?
GHSA-v73w-r9xg-7cr9 is a cross-site scripting vulnerability in october/october, published on 5 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
Patches
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.
Workarounds
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.
References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- https://jquery.com/upgrade-guide/3.5/
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected] & [email protected]
Threat Assessment
Assessed as Moderate by the @jquery team.
Acknowledgements
Thanks to @mrgswift for reporting the issue to the October CMS team.
Which versions are affected by GHSA-v73w-r9xg-7cr9?
4 open source packages ship an affected version, including october/october and october/system.
| Package | Affected | Fixed in |
|---|---|---|
october/october Packagist | From 1.0.319 | 1.0.466 |
october/october Packagist | From 1.0.319 | 1.0.466 |
october/system Packagist | From 1.0.319 | 1.0.466 |
october/system Packagist | From 1.0.319 | 1.0.466 |
How do I fix GHSA-v73w-r9xg-7cr9?
Upgrade october/october to 1.0.466 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-v73w-r9xg-7cr9 being exploited?
There is no known exploitation of GHSA-v73w-r9xg-7cr9 in the wild and no public exploit code.