CVE-2018-15494: Critical vulnerability in dojox
Summary
CVE-2018-15494: dojox vulnerable to unescaped string injection. Affects dojox versions < 1.14.0. Fixed in 1.14.0. How to fix ↓
Also tracked for
- dojo · Debian:11
The same CVE-2018-15494 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dojox is an open-source JavaScript toolkit that provides a wide range of utilities and widgets for web development. It is commonly used to build interactive and dynamic web applications. The dojox/Grid/DataGrid component is specifically designed for creating data grids and tables. However, a critical vulnerability has been discovered in Dojo Toolkit versions prior to 1.14, specifically in the dojox/Grid/DataGrid module.
Vulnerability Detail
The vulnerability in dojox/Grid/DataGrid is related to unescaped string injection. This means that user-supplied input is not properly sanitized or escaped when displayed in the data grid, leading to potential cross-site scripting (XSS) attacks. An attacker could exploit this vulnerability by injecting malicious code into the grid, which would then be executed by unsuspecting users who view the grid. This could result in unauthorized access to sensitive information, session hijacking, or other malicious activities.
How To Fix
Minimum fixed version
1.14.0
This is the first release that contains the fix.
npm install dojox@1.14.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Dojo Toolkit is not immediately feasible, a temporary workaround is to manually sanitize and escape user-supplied input before displaying it in the data grid. This can be achieved by using appropriate JavaScript functions or libraries for input sanitization and escaping, such as DOMPurify or the built-in escape functions provided by Dojo Toolkit. Here's an example of how to sanitize and escape user input using DOMPurify:
var sanitizedInput = DOMPurify.sanitize(userInput);
var escapedInput = dojo.html.entities.encode(sanitizedInput);
Conclusion
In conclusion, the dojox/Grid/DataGrid component in Dojo Toolkit versions prior to 1.14 is vulnerable to unescaped string injection, which can lead to cross-site scripting (XSS) attacks. To mitigate this risk, it is highly recommended to upgrade to the latest version of Dojo Toolkit. If immediate upgrade is not possible, manually sanitizing and escaping user input can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dojox →
FAQ
This vulnerability allows an attacker to inject malicious code into the dojox/Grid/DataGrid component, potentially leading to cross-site scripting (XSS) attacks. The impact can range from unauthorized access to sensitive information to session hijacking and other malicious activities.
Versions of Dojo Toolkit prior to 1.14 are affected by this vulnerability. It is recommended to upgrade to version 1.14 or later to mitigate the risk.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended patches or upgrades to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
You can find more information about this vulnerability, including the official CVE identifier (CVE-2018-15494), in the National Vulnerability Database (NVD) or the GitHub Advisory Database.
Related vulnerabilities
Recent vulnerabilities recorded for dojox.
