Steps to Reproduce
This Medium level exploit (CVE-2020-11023) is related to CVE-2020-11022; it can be found in jQuery versions greater than or equal to 1.0.3 and before 3.5.0. Instead of being concerned with general HTML (which CVE-2020-11022 handles), this problem may occur when passing HTML containing <option> elements, even after sanitizing it, to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others). With a specially-crafted input, even after sanitizing it, these methods may execute untrusted code.
Addressing the Issue
Clients should update to jQuery v3.5.0 immediately after thorough testing. Extensive testing is required because the normalization logic in the jQuery.htmlPrefilter() method changed in v3.5.0 and there are edge cases in which the normalization functionality may produce unexpected results. If the old behavior is absolutely required, the jQuery 3.5.0 Release blog describes a way to use the old logic in a safe way.
Learning and Prevention
Sanitizing untrusted data before using or storing it is a security best practice for good reason: it is a common vector for breaking code. In this case, the normalization logic used in jQuery manipulation methods has an the error that specifically affects <option> elements even in sanitized HTML data.
If you are going to use untrusted data, the jQuery team recommends using the DOMPurify library for sanitization and to be sure to use the SAFE_FOR_JQUERY option. DOMPurify is a very popular, highly configurable library specifically designed to help prevent Cross-Site Scripting (XSS) exploits.
Conclusion
To provide the most secure possible JavaScript libraries for their sites, HeroDevs NES clients receive versions of jQuery with this and all other relevant CVEs fixed.
This fix directly corrects the potential security hole described by CVE-2020-11023. To stay apprised of security updates like these, contact us today to become a customer.
Resources
