CVE-2017-1000043: Content Injection via TileJSON Name in mapbox.js
Summary
CVE-2017-1000043: Content Injection via TileJSON Name in mapbox.js. Affects mapbox.js across 2 version ranges.
< 1.6.6
>= 2.0.0, < 2.2.4
Fixed in 1.6.6 or 2.2.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mapbox.js is an open-source JavaScript library that provides a set of tools for creating interactive maps. It is commonly used in web applications to display and manipulate map data. The library allows users to control the TileJSON content, which defines the properties of the map tiles. However, versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 of mapbox.js are vulnerable to a content injection vulnerability when users have control over the TileJSON name value.
Vulnerability Detail
The content injection vulnerability in mapbox.js allows an attacker to inject malicious script content into the name value of the TileJSON. This can occur when the functions L.mapbox.map or L.mapbox.shareControl are used in a way that gives users control over the TileJSON content. When a user clicks on the share control, the injected script will execute in the context of the page using Mapbox.js. This vulnerability can lead to cross-site scripting (XSS) attacks and potential unauthorized access to user data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.6.61.6.6npm install mapbox.js@1.6.6 -
>= 2.0.0, < 2.2.42.2.4npm install mapbox.js@2.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to update to the latest version of mapbox.js to address the issue.
Conclusion
In conclusion, the content injection vulnerability in mapbox.js can allow attackers to inject malicious script content into the TileJSON name value, leading to potential XSS attacks and unauthorized access to user data. It is important to update to the latest version of mapbox.js to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mapbox.js →
FAQ
mapbox.js is an open-source JavaScript library used for creating interactive maps in web applications.
TileJSON is a specification that defines the properties of map tiles, including their URLs, attribution, and other metadata.
The vulnerability occurs when users have control over the TileJSON content and can inject malicious script content into the name value.
The vulnerability can lead to cross-site scripting (XSS) attacks and potential unauthorized access to user data.
To fix the vulnerability, update to the latest version of mapbox.js (1.6.6 or later for version 1.x, 2.2.4 or later for version 2.x).
Related vulnerabilities
Recent vulnerabilities recorded for mapbox.js.
