CVE-2019-10785

Overview

Dojox (or “Dojo Toolkit”) is a collection of optional, extended, and experimental modules for the Dojo Toolkit that provide additional UI widgets, utilities, and advanced features beyond the core Dojo libraries.

‍

A medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2019-10785) has been identified in Dojox. The XML encoding logic for users of dojox/xmpp and dojox/dtl could allow attackers to inject malicious scripts through unescaped user-supplied content in XML contexts, widget labels, and template attributes, leading to arbitrary code execution.

‍

Per OWASP: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

‍

Details

Module Info

• Product: Dojo
• Affected packages: dojox
• Affected versions:
  <1.11.10,
  >=1.12.0 <1.12.8,
  >=1.13.0 <1.13.7,
  >=1.14.0 <1.14.6,
  >=1.15.0 <1.15.3,
  >=1.16.0 <1.16.1
• GitHub repository: https://github.com/dojo/dojox
• Published packages: https://www.npmjs.com/package/dojox
• Package manager: npm
• Fixed in: NES for Dojo v1.7.5, OSS v1.11.10, OSS v1.12.8, OSS v1.13.7, OSS v1.14.6, OSS v1.15.3, OSS v1.16.1

‍

Vulnerability Info

This medium-severity vulnerability is found in many versions of Dojox less than 1.16.1. See the affected versions above for specific details.

‍

The vulnerability affected three areas:

• dojox.xmpp.util.xmlEncode() used inadequate escaping when encoding XML names sent to XMPP servers, potentially affecting servers without proper input validation or users who add the output directly to DOM.
• dojox.widget.RollingList._getMenuItemForItem() rendered store item labels without escaping, allowing XSS through malicious label content.
• dojox.dtl.dom.getTemplate() constructed template attributes without quote escaping, enabling attribute-based XSS injection.

‍

This vulnerability could be exploited by:

• providing crafted content or labels containing special characters (<, >, &, ", ')
• injecting script tags or event handlers through unescaped content
• downstream systems that trust the inadequately-escaped output

‍

Mitigation

Dojox version 1.7.x is End-of-Life and will not receive any updates to address this issue. For more information see the Dojo website announcement.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a fixed version of Dojox and Dojo.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Jonathan Leitschuh (analyst)