CVE-2018-6561

Overview

Dijit is a widget and UI component library built on Dojo that provides accessible, themeable, and feature-rich form controls, layout containers, editors, and interactive elements for building enterprise web applications.

‍

A medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2018-6561) has been identified in Dijit. The view source feature allows attackers to bypass content restrictions and inject HTML attributes and JavaScript event handlers, leading to arbitrary code execution.

‍

Per OWASP: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

‍

Details

Module Info

• Product: Dojo
• Affected packages: dijit
• Affected versions:
  <1.10.10,
  >=1.11.0 <1.11.6,
  >=1.12.0 <1.12.4,
  >=1.13.0 <1.13.1
• GitHub repository: https://github.com/dojo/dijit
• Published packages: https://www.npmjs.com/package/dijit
• Package manager: npm
• Fixed in: NES for Dojo v1.7.5, OSS v1.10.10, OSS v1.11.6, OSS v1.12.4, OSS v1.13.1

‍

Vulnerability Info

This medium-severity vulnerability is found in many versions of Dojo less than 1.13.1. See the affected versions above for specific details.

‍

The ViewSource plugin's _filter method in dijit/_editor/plugins/ViewSource.js filters HTML content through several stripping methods (_stripScripts, _stripComments, _stripIFrames) but did not remove event handler attributes. This allowed attackers to bypass script tag filtering by injecting event handlers directly into HTML elements.

‍

Attack vectors included payloads like <svg onload="alert(document.domain)"> or <img onerror="alert(1)" src=x>. When users toggled to source view mode, entered malicious content, and switched back to WYSIWYG mode, the injected JavaScript would execute when the element loaded or when users interacted with the affected elements.

‍

Mitigation

Dijit version 1.7.x is End-of-Life and will not receive any updates to address this issue. For more information see the Dojo website announcement.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a fixed version of Dojo/Dijit.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍