CVE-2016-1000228: DOM-based XSS in gmail-js
Summary
CVE-2016-1000228: DOM-based XSS in gmail-js. Affects gmail-js versions < 0.6.5. Fixed in 0.6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gmail-js package is an npm package that provides a JavaScript library for interacting with Gmail's API. It allows developers to perform various actions such as parsing responses, retrieving visible emails, and getting email data. The package is widely used to integrate Gmail functionality into web applications.
Vulnerability Detail
The vulnerability in gmail-js is a DOM-based cross-site scripting (XSS) issue. Specifically, the tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post functions are affected. These functions directly pass user input into the Function constructor without proper sanitization or validation. This allows an attacker to inject malicious scripts into the application, which can be executed in the context of other users' browsers. The impact of this vulnerability can range from stealing sensitive information to performing unauthorized actions on behalf of the user.
How To Fix
Minimum fixed version
0.6.5
This is the first release that contains the fix.
npm install gmail-js@0.6.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to manually sanitize and validate user input before passing it to the affected functions. This can be done using appropriate security libraries or custom validation logic. Here's an example of how to sanitize user input using the DOMPurify library:
const DOMPurify = require('dompurify');
const sanitizedInput = DOMPurify.sanitize(userInput);
// Pass sanitizedInput to the affected functions
Note that this workaround is not a permanent solution and should be replaced with the recommended update as soon as possible.
Conclusion
The gmail-js package is vulnerable to a DOM-based XSS issue, which can have severe security implications. It is crucial to update to version 0.6.5 or later to mitigate this vulnerability. If immediate updating is not possible, manual input sanitization and validation can be used as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gmail-js →
FAQ
The vulnerability allows an attacker to execute malicious scripts in the context of other users' browsers, potentially leading to the theft of sensitive information or unauthorized actions on behalf of the user.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the recommended fix is to update to version 0.6.5 or later of the gmail-js package. This version includes the necessary security patches to prevent the XSS vulnerability.
Yes, a temporary workaround is to manually sanitize and validate user input before passing it to the affected functions. However, this is not a permanent solution and should be replaced with the recommended update as soon as possible.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-c7pp-g2v2-2766/GHSA-c7pp-g2v2-2766.json
