CVE-2019-8331
Cross-Site Scripting (XSS) vulnerability in bootstrap

What is CVE-2019-8331 About?

This vulnerability is a Cross-Site Scripting (XSS) issue in `bootstrap` versions prior to 3.4.1 (for 3.x) and 4.3.1 (for 4.x). It enables attackers to execute arbitrary JavaScript due to a lack of input sanitization in the `data-template` attribute of tooltip and popover plugins. The ease of exploitation is moderate, requiring specific conditions to be met.

Affected Software

Technical Details

The XSS vulnerability in `bootstrap` arises because the `data-template` attribute used by the tooltip and popover plugins does not properly sanitize user-supplied input. An attacker can craft a malicious string containing JavaScript code and inject it into the `data-template` attribute through an application that uses vulnerable `bootstrap` versions and allows user-controlled input into these attributes. When a user interacts with the affected tooltip or popover, the embedded JavaScript will be executed in the context of the user's browser, leading to client-side code execution. This is a client-side vulnerability where the malicious payload is delivered via the HTML structure.

What is the Impact of CVE-2019-8331?

Successful exploitation may allow attackers to execute arbitrary client-side scripts, compromise user sessions, plant web skimmers, or deface web content.

What is the Exploitability of CVE-2019-8331?

Exploitation of this XSS vulnerability requires moderate complexity, as the attacker needs to inject malicious content into the `data-template` attribute of `bootstrap` tooltips or popovers. This usually implies that the attacker has control over some data displayed by the application that is then rendered into these specific attributes without proper sanitization. No specific authentication is required at the point of script execution; the malicious script runs in the context of the authenticated user. This is typically a remote attack, where the payload is sent to the victim's browser through a vulnerable web application. Prerequisites include an application utilizing vulnerable versions of `bootstrap` and allowing untrusted data to populate the `data-template` attribute. The absence of robust input validation and output encoding for content rendered within these UI components significantly increases the risk.

What are the Known Public Exploits?

What are the Available Fixes for CVE-2019-8331?

Available Upgrade Options

• bootstrap.sass
  • <4.3.1 → Upgrade to 4.3.1
• bootstrap-sass
  • >3.0.0, <3.4.1 → Upgrade to 3.4.1
• bootstrap
  • >3.0.0, <3.4.1 → Upgrade to 3.4.1
• bootstrap
  • >4.0.0, <4.3.1 → Upgrade to 4.3.1
• Bootstrap.Less
  • >3.0.0, <3.4.1 → Upgrade to 3.4.1
• twbs/bootstrap
  • >3.0.0, <3.4.1 → Upgrade to 3.4.1
• twbs/bootstrap
  • >4.0.0, <4.3.1 → Upgrade to 4.3.1
• org.webjars:bootstrap
  • >3.0.0, <3.4.1 → Upgrade to 3.4.1
• org.webjars:bootstrap
  • >4.0.0, <4.3.1 → Upgrade to 4.3.1

Additional Resources

• https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
• https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E
• https://access.redhat.com/errata/RHSA-2019:1456
• https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E
• http://seclists.org/fulldisclosure/2019/May/11
• https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
• https://support.f5.com/csp/article/K24383845
• https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1
• https://support.f5.com/csp/article/K24383845?utm_source=f5support&amp%3Butm_medium=RSS
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E

What are Similar Vulnerabilities to CVE-2019-8331?

Similar Vulnerabilities: CVE-2019-16769 , CVE-2020-28498 , CVE-2021-3803 , CVE-2018-12536 , CVE-2017-1000159