CVE-2021-41183

Overview

jQuery UI is a user interface library built on top of jQuery, providing a collection of widgets, interactions, effects, and themes for building rich, interactive web applications.

‍

A moderate-severity Cross-Site Scripting (XSS) vulnerability (CVE-2021-41183) has been identified in jQuery UI. The Datepicker widget's text option handling could allow attackers to inject malicious scripts through unescaped user-supplied content in the appendText, buttonText, prevText, nextText, currentText, and closeText options, leading to arbitrary code execution.

‍

Per OWASP: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

‍

Details

Module Info

• Product: jQuery UI
• Affected packages: jquery-ui
• Affected versions: <1.13.0
• GitHub repository: https://github.com/jquery/jquery-ui
• Published packages: https://www.npmjs.com/package/jquery-ui
• Package manager: npm
• Fixed in:
  
  • OSS v1.13.0
  • NES for jQuery UI v1.8.26

‍

Vulnerability Info

This moderate-severity vulnerability is found in jQuery UI versions less than 1.13.0. See the affected versions above for specific details.

‍

The vulnerability affected six text options in the Datepicker widget:

‍

• appendText used HTML string concatenation in the _attachments method, allowing script injection through text displayed after the input field.
• buttonText rendered trigger button text using the .html() method without escaping, enabling XSS through the button label.
• prevText constructed previous month navigation links via HTML string building, allowing injection in navigation controls.
• nextText constructed next month navigation links via HTML string building, allowing injection in navigation controls.
• currentText built "Today" button HTML through string concatenation, enabling XSS in the button panel.
• closeText built "Close" button HTML through string concatenation, enabling XSS in the button panel.

‍

This vulnerability could be exploited by:

‍

• providing crafted content in text options containing script tags or event handlers
• injecting malicious payloads like <script>alert(document.cookie)</script> through any of the six text options
• exploiting applications that populate these options from user-controlled data sources

‍

Mitigation

jQuery UI version 1.8.x is End-of-Life and will not receive any updates to address this issue from the jQuery team.

‍

Users of the affected Datepicker widget should apply one of the following mitigations:

‍

• Upgrade affected applications to jQuery UI 1.13.0 or later.
• Validate and sanitize any values from untrusted sources before passing them to the Datepicker.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍