GMS-2020-309: Cross-Site Scripting in jquery-mobile
(updated )
All version of jquery-mobile are vulnerable to Cross-Site Scripting. The package checks for content in location.hash and if a URL is found it does an XmlHttpRequest (XHR) to the URL and renders the response with innerHTML. It fails to validate the Content-Type of the response, allowing attackers to include malicious payloads as part of query parameters that are reflected back to the user. A response such as {"q":"<iframe/src='javascript:alert(1)'></iframe>","results":[]} would be parsed as HTML and the JavaScript payload executed. No fix is currently available. Consider using an alternative package until a fix is made available.
References
- gist.github.com/jupenur/e5d0c6f9b58aa81860bf74e010cf1685
- github.com/advisories/GHSA-fj93-7wm4-8x2g
- github.com/jquery/jquery-mobile/commit/b0d9cc758a48f13321750d7409fb7655dcdf2b50
- github.com/jquery/jquery-mobile/issues/8640
- github.com/jquery/jquery-mobile/pull/8649
- github.com/jquery/jquery-mobile/pull/8650
- snyk.io/vuln/SNYK-JS-JQUERYMOBILE-174599
- www.npmjs.com/advisories/883
Code Behaviors & Features
Detect and mitigate GMS-2020-309 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →