PT-2020-21058 · Google+1 · Jqlite+2

Published 2020-08-05 · Updated 2020-08-05

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions AngularJS versions prior to 1.8.0

Description A potential issue may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods. The jqLiteBuildFragment function in JQLite manipulates input HTML before inserting it into the DOM, which can modify some forms of sanitized payload into a payload containing JavaScript and trigger an XSS when the payload is inserted into the DOM. This issue is similar to a bug in jQuery's htmlPrefilter function.

Recommendations For AngularJS versions prior to 1.8.0, upgrade to AngularJS 1.8.0 to resolve the issue. If using JQuery, upgrade JQuery to 3.5.0, as a similar vulnerability affects jQuery versions prior to 3.5.0. As a temporary workaround, consider changing the sanitizer configuration to not allow certain tag grouping or inline style elements, but note that this may not cover all possible exploitation vectors.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-5CP4-XMRW-59WF

Affected Products

Angularjs

Jqlite

Jquery

References · 8

• https://osv.dev/vulnerability/GHSA-5cp4-xmrw-59wf · Vendor Advisory
• https://github.com/angular/angular.js · Note
• https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 · Note
• https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 · Note
• https://github.com/google/security-research/security/advisories/GHSA-5cp4-xmrw-59wf · Note
• https://github.com/advisories/GHSA-mhp6-pxh8-r675 · Note
• https://blog.jquery.com/2020/04/10/jquery-3-5-0-released · Note
• https://snyk.io/vuln/SNYK-JS-ANGULAR-570058 · Note