PT-2018-17489 · Facebook · React-Dom

Dan Abramov · Published 2018-12-31 · Updated 2019-10-09 · CVE-2018-6341

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions react-dom versions 16.0.0 through 16.0.0 react-dom versions 16.1.0 through 16.1.1 react-dom versions 16.2.0 through 16.2.0 react-dom versions 16.3.0 through 16.3.2 react-dom versions 16.4.0 through 16.4.1

Description The issue is related to a cross-site scripting vulnerability in React applications that render to HTML using the ReactDOMServer API. The lack of escaping of user-supplied attribute names at render-time could lead to this vulnerability. This may allow attackers to execute arbitrary JavaScript in the victim's browser. The application needs to be a server-side React app, rendered to HTML using ReactDOMServer, and include an attribute name from user input in an HTML tag to be affected by this vulnerability.

Recommendations If you are using react-dom 16.0.x, upgrade to 16.0.1 or later. If you are using react-dom 16.1.x, upgrade to 16.1.2 or later. If you are using react-dom 16.2.x, upgrade to 16.2.1 or later. If you are using react-dom 16.3.x, upgrade to 16.3.3 or later. If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-6341

GHSA-MVJJ-GQQ2-P4HW

Affected Products

React-Dom

References · 9

• https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html · Vendor Advisory
• https://twitter.com/reactjs/status/1024745321987887104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6341 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6341 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mvjj-gqq2-p4hw · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6341 · Note
• https://github.com/advisories/GHSA-mvjj-gqq2-p4hw · Note
• https://snyk.io/vuln/npm:react-dom:20180802 · Note
• https://npmjs.com/advisories/1421 · Note