CVE-2018-20677: XSS vulnerability in bootstrap (npm)

What is CVE-2018-20677 About?

This vulnerability allows for Cross-Site Scripting (XSS) in Bootstrap before version 3.4.0, specifically in the affix configuration target property. An attacker can inject malicious client-side scripts, which could be executed in the victim's browser. Exploitation is relatively straightforward, requiring the ability to control the affected property's value.

Affected Software

bootstrap
- <3.4.0
- <3.4.0
- <3.4.0
bootstrap-sass
- <3.4.0
- <3.4.0
twbs/bootstrap
- <3.4.0
org.webjars:bootstrap
- <3.4.0

Technical Details

The XSS vulnerability in Bootstrap arises from insufficient sanitization or encoding of user-controlled input in the 'affix configuration target property.' The 'affix' component in Bootstrap allows an element to become fixed to the top of the viewport after scrolling a certain amount. The configuration, including the 'target' property, can often be dynamically set, potentially from user-provided data. If an attacker can inject malicious JavaScript code into this 'target' property, and this property's value is then rendered into the DOM without proper escaping, the injected script will be executed in the context of the user's browser. This could allow for session hijacking, defacement, or redirection to malicious sites.

What is the Impact of CVE-2018-20677?

Successful exploitation may allow attackers to inject arbitrary client-side scripts into web pages, leading to session hijacking, defacement of the affected website, or redirection of users to malicious sites.

What is the Exploitability of CVE-2018-20677?

Exploitation of this XSS vulnerability typically requires an attacker to be able to control or influence the value assigned to the affix configuration's 'target' property. This might involve submitting malicious data through a web form, manipulating URL parameters that feed into the property, or leveraging other input vectors. The attack is client-side and remote, meaning the attacker modifies data that is displayed to another user. No specific authentication or privilege is required from the attacker's perspective, beyond the ability to submit the malicious input. The complexity is low once an input vector is identified, making it an easy-to-exploit flaw if the conditions are met. Poor input validation on the server-side feeding this property would significantly increase the exploitation likelihood.

What are the Known Public Exploits?

PoC Author	Link	Commentary
No known exploits

What are the Available Fixes for CVE-2018-20677?

A Fix by Resolved Security Exists!

See how we help you strengthen security with automated backported fixes for your libraries.

About the Fix from Resolved Security

The patch changes selectors for parent, container, target, and viewport options in various Bootstrap components to always use $(document).find(...) instead of passing potentially unsafe selector values directly to jQuery functions. This prevents attackers from injecting malicious selectors (such as <img onerror=...>) that could trigger jQuery's selector engine to execute JavaScript, thereby fixing the CVE-2018-20677 reflected XSS vulnerability.

Available Upgrade Options

org.webjars:bootstrap
- <3.4.0 → Upgrade to 3.4.0
bootstrap-sass
- <3.4.0 → Upgrade to 3.4.0
bootstrap
- <3.4.0 → Upgrade to 3.4.0
twbs/bootstrap
- <3.4.0 → Upgrade to 3.4.0

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2018-20677?

Similar Vulnerabilities: CVE-2018-12538 , CVE-2018-12539 , CVE-2018-1000652 , CVE-2018-1000657 , CVE-2018-1000658

CVE-2018-20677 XSS vulnerability in bootstrap (npm)