Security Fix for Cross-site Scripting (XSS) - huntr.dev

huntr-helper commented 4 years ago

https://huntr.dev/users/Mik317 has fixed the Cross-site Scripting (XSS) vulnerability 🔨. Mik317 has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

User Comments:

📊 Metadata *

Please enter the direct URL for this bounty on huntr.dev. This is compulsory and will help us process your bounty submission quicker.

Bounty URL: https://www.huntr.dev/bounties/1-npm-form

⚙️ Description *

The form library suffered of a XSS issue, which was caused by 2 minor issues inside the code, which made possible the usage of eval on unsanitized values (inside the "override" of parseJSON) and html parsing on a unsanitized AJAX response.

💻 Technical Description *

The 2 issues have been fixed in the following way:

The eval inside the parseJSON function has been removed, while it's been added a error which arises when the default $.parseJSON function (on jquery) isn't declared (anyone with good intentions would simply add the jquery script on the page and all works correctly again).
The unsanitized AJAX response was previously passed to parseHTML without any check, making possible inject additional HTML. I used a peculiarity of jquery to translate the HTML nodes evaluated into text nodes, which are equal to HTML encoded entities (can be verified seeing this: )

🐛 Proof of Concept (PoC) *

No PoC was provided, so I worked mostly theoretically on the issue/lines identified by the 2 issues in the original repo

🔥 Proof of Fix (PoF) *

Theoretical fix :smile:

👍 User Acceptance Testing (UAT)

Can't be sure of this but seems all OK (nodes are still nodes of different type and a function is null --> arises exception due to a function undefined)

brettz9 commented 3 years ago

Could we get this high severity XSS vulnerability security bug looked at?

brettz9 commented 3 years ago

If the project is abandoned, please let us know, but if not, it's coming close to a year for a couple lines fix for a security bug... Thanks!

covalesj commented 1 year ago

Just a ping on this -- its a high vuln, with a fix, can someone with writeaccess merge this in?

jquery-form / form