CVE-2021-23398: Cross-site scripting in react-bootstrap-table
Summary
CVE-2021-23398: Cross-site scripting in react-bootstrap-table. Affects react-bootstrap-table versions < 4.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React-bootstrap-table is an npm package that provides a React-based table component for displaying data in a tabular format. It is widely used in web applications to present data in a structured manner. However, all versions of react-bootstrap-table are vulnerable to a Cross-site Scripting (XSS) attack. This vulnerability occurs when an invalid React element is returned, leading to the use of dangerouslySetInnerHTML without proper sanitization of the output.
Vulnerability Detail
The vulnerability in react-bootstrap-table allows an attacker to inject malicious code into the application, which can be executed in the context of the user's browser. This can lead to various security risks, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or manipulating the content of the web page. The vulnerability is rated as moderate severity with a CVSS score of 6.1. The CWE ID associated with this vulnerability is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating react-bootstrap-table is not immediately feasible, a temporary workaround is to manually sanitize the data before passing it to the dataFormat parameter. This can be done using libraries like DOMPurify to sanitize the HTML content. Here's an example of how to use DOMPurify to sanitize the data:
import DOMPurify from 'dompurify';
const sanitizedData = DOMPurify.sanitize(data);
Conclusion
In conclusion, react-bootstrap-table is vulnerable to a Cross-site Scripting (XSS) attack due to the use of dangerouslySetInnerHTML without proper sanitization. Developers should update the package to the latest version or manually sanitize the data before passing it to the vulnerable parameter. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for react-bootstrap-table →
FAQ
React-bootstrap-table is an npm package that provides a React-based table component for displaying data in a tabular format. It is widely used in web applications to present data in a structured manner.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various security risks, such as stealing sensitive information or performing unauthorized actions on behalf of the user.
The vulnerability in react-bootstrap-table occurs when an invalid React element is returned, leading to the use of dangerouslySetInnerHTML without proper sanitization of the output. This allows an attacker to inject malicious code into the application.
The potential risks of this vulnerability include the theft of sensitive information, unauthorized actions performed on behalf of the user, and manipulation of the web page content.
To fix this vulnerability, you should update react-bootstrap-table to a version that includes a patch for the XSS issue. The latest version of react-bootstrap-table is not affected by this vulnerability.
