CVE-2021-41182

Overview

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery that provides developers with a comprehensive collection of UI components for building interactive web applications.

‍

A moderate-severity Cross-Site Scripting (XSS) vulnerability (CVE-2021-41182) has been identified in jQuery UI. The altField option of the Datepicker widget could allow attackers to inject malicious scripts when values from untrusted sources are accepted, leading to arbitrary code execution when the alternate field is updated.

‍

Per OWASP: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

‍

Details

Module Info

• Product: jQuery UI
• Affected packages: jquery-ui
• Affected versions: <1.13.0
• GitHub repository: https://github.com/jquery/jquery-ui
• Published packages: https://www.npmjs.com/package/jquery-ui
• Package manager: npm
• Fixed in:
  
  • OSS v1.13.0
  • NES for jQuery UI v1.8.26

‍

Vulnerability Info

This medium-severity vulnerability is found in versions of jQuery UI less than 1.13.0. See the affected versions above for specific details.

‍

The vulnerability affected the Datepicker widget's _updateAlternate method:

‍

• _updateAlternate() passed the altField option value directly to jQuery's $() constructor without validation, allowing the constructor to interpret it as HTML rather than a CSS selector.
• This enabled attackers to inject arbitrary HTML elements with JavaScript event handlers that would execute when the alternate field was updated.
• Applications accepting the altField value from untrusted sources were particularly vulnerable.

‍

This vulnerability could be exploited by:

‍

• initializing the Datepicker with a crafted altField value containing HTML, such as: <img onerror='doEvilThing()' src='/404' />
• injecting script tags or event handlers through the unvalidated option value
• exploiting applications that allow user-controlled Datepicker configuration

‍

Mitigation

jQuery UI version 1.8.x is End-of-Life and will not receive any updates to address this issue from the jQuery team.

‍

Users of the affected Datepicker widget should apply one of the following mitigations:

‍

• Upgrade affected applications to a fixed version of jQuery UI.
• Validate and sanitize any values from untrusted sources before passing them to the Datepicker.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍