CVE-2016-1000240: Cross-Site Scripting in c3
Summary
CVE-2016-1000240: Cross-Site Scripting in c3. Affects c3 versions < 0.4.11. Fixed in 0.4.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The c3 package is an npm package used for creating interactive charts and graphs. It provides a simple and intuitive API for generating various types of charts. However, versions of c3 up to and including 0.4.10 are vulnerable to a cross-site scripting (XSS) attack due to improper sanitization of HTML in rendered tooltips.
Vulnerability Detail
The vulnerability in c3 allows an attacker to inject malicious scripts into the tooltips of the generated charts. When a user hovers over a data point on the chart, the tooltip is displayed, and if the tooltip content is not properly sanitized, the injected script will be executed in the context of the user's browser. This can lead to various attacks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user.
How To Fix
Minimum fixed version
0.4.11
This is the first release that contains the fix.
npm install c3@0.4.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to disable tooltips or manually sanitize the tooltip content before rendering it. Here's an example of how to manually sanitize the tooltip content using the DOMPurify library:
const DOMPurify = require('dompurify');
const tooltipContent = getTooltipContent(); // Retrieve the tooltip content
const sanitizedContent = DOMPurify.sanitize(tooltipContent);
// Render the sanitized tooltip content
renderTooltip(sanitizedContent);
Conclusion
The c3 package up to version 0.4.10 is vulnerable to a cross-site scripting (XSS) attack due to improper sanitization of HTML in tooltips. To mitigate this vulnerability, it is recommended to update to version 0.4.11 or later. If immediate updating is not possible, you can use the provided workaround or consult the Vulert Playground for further assistance. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for c3 →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to sensitive information theft or unauthorized actions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any known vulnerabilities, including this one.
Yes, updating to version 0.4.11 or later of the c3 package fixes this vulnerability by implementing proper sanitization of HTML in tooltips.
Yes, you can temporarily disable tooltips or manually sanitize the tooltip content before rendering it. Refer to the 'workaround' section for an example of how to manually sanitize the content.
You can find more information about this vulnerability, including its impact and technical details, in the advisory published at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-gvg7-pp82-cff3/GHSA-gvg7-pp82-cff3.json
