Steps to Reproduce
The jQuery $.load() command provides a simple way to load HTML content from the server and insert it into the current web page. By design, it is supposed to remove <script> tags, when called with a selector.
Due to vulnerability CVE-2020-7656, it fails to recognize and remove <script> tags that contain a whitespace character, which can result in Cross-Site Scripting (XSS) attacks by including malicious code in the included script.
Addressing the Issue
Clients using jQuery prior to v1.9.1 should upgrade immediately to this version, which contains the fix. Alternatively, clients who need to still remain on 1.6 may leverage HeroDevs Never-Ending Support which provides versions of jQuery with this and other CVEs remediated.
Learning and Prevention
Typically, jQuery $.load() can guard against the execution of <script> tags when loading a page fragment. In this case, the method's logic had a flaw that lead to a vulnerability. In these cases, the best business practice is to stay abreast of security updates so that your servers are vulnerable for the least amount of time once the exploit has been published publicly.
Conclusion
HeroDevs jQuery Never-Ending Support can make your team’s life easier and more convenient by ensuring that it has the latest, secure code for all your important dependencies. Contact HeroDevs today to sign up for our comprehensive support service.
Resources
NIST CVE-2020-7656 entry
