CVE-2018-6561: dijit editor cross-site scripting vulnerability
Summary
CVE-2018-6561: dijit editor cross-site scripting vulnerability. Affects dijit versions < 1.13.1. Fixed in 1.13.1. How to fix ↓
Also tracked for
- dojo · Debian:11
The same CVE-2018-6561 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dijit package is a part of the Dojo Toolkit, a JavaScript framework that provides a collection of utilities and widgets for building web applications. The dijit.Editor module is a rich text editor widget that allows users to input and format text content. It is commonly used in web forms and content management systems. However, a vulnerability has been discovered in dijit.Editor version 1.13 and below that allows for cross-site scripting (XSS) attacks. This vulnerability can be exploited by injecting malicious code through the onload attribute of an SVG element.
Vulnerability Detail
The dijit.Editor vulnerability (CVE-2018-6561) arises from a lack of proper input sanitization in the onload attribute of SVG elements. An attacker can craft a specially crafted SVG element with a malicious onload attribute, which will be executed when the SVG is loaded in the editor. This allows the attacker to execute arbitrary JavaScript code in the context of the user's session, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.13.1
This is the first release that contains the fix.
npm install dijit@1.13.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, a temporary workaround is to disable the use of SVG elements in the dijit.Editor widget. This can be achieved by modifying the code that generates the editor or by implementing a content filter that removes any SVG elements before they are rendered in the editor. Here is an example of how to disable SVG elements in the editor:
// Disable SVG elements in dijit.Editor
editor.onLoadDeferred.then(function() {
var iframe = editor.iframe;
var svgElements = iframe.contentDocument.getElementsByTagName('svg');
Array.prototype.forEach.call(svgElements, function(svg) {
svg.parentNode.removeChild(svg);
});
});
Conclusion
The dijit.Editor cross-site scripting vulnerability (CVE-2018-6561) in Dojo Toolkit 1.13 and below can be exploited to execute arbitrary JavaScript code in the context of a user's session. To mitigate this risk, it is crucial to upgrade to dijit.Editor version 1.13.1 or above. If immediate upgrading is not possible, disabling the use of SVG elements in the editor can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dijit →
FAQ
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized access, data theft, and other malicious activities. It poses a moderate risk to web applications that use dijit.Editor version 1.13 and below.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze your dependencies and alert you if any vulnerable versions are detected.
Yes, the vulnerability has been fixed in dijit.Editor version 1.13.1 and above. It is recommended to upgrade to the latest version to mitigate the risk.
If upgrading to the patched version is not immediately feasible, you can temporarily disable the use of SVG elements in the dijit.Editor widget. Refer to the 'workaround' section for more details.
You can find more information about this vulnerability in the GitHub Advisory Database. The advisory for this specific vulnerability can be accessed at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wp32-wq34-2rqh/GHSA-wp32-wq34-2rqh.json
Related vulnerabilities
Recent vulnerabilities recorded for dijit.
