CVE-2021-23414: Cross-site Scripting in video.js
Summary
CVE-2021-23414: Cross-site Scripting in video.js. Affects video.js versions < 7.14.3. Fixed in 7.14.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
video.js is an open-source JavaScript framework for building video players on the web. It provides a comprehensive set of features for video playback, including support for multiple video formats, customizable player controls, and integration with various video streaming platforms. However, video.js versions before 7.14.3 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability arises from the src attribute of the track tag, which allows bypassing HTML escaping and executing arbitrary code.
Vulnerability Detail
The cross-site scripting vulnerability in video.js (CVE-2021-23414) enables an attacker to inject malicious code into a web page that uses the affected version of the package. By exploiting this vulnerability, an attacker can execute arbitrary JavaScript code in the context of the user's browser, potentially leading to various security risks. This could include stealing sensitive information, performing actions on behalf of the user, or manipulating the content of the web page.
How To Fix
Minimum fixed version
7.14.3
This is the first release that contains the fix.
npm install video.js@7.14.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the input provided to the src attribute of the track tag. This can be done by using a library or function that escapes special characters and prevents the execution of JavaScript code. Here is an example of how to sanitize the src attribute using the 'he' library in JavaScript:
const he = require('he');
const sanitizedSrc = he.encode(src);
Conclusion
The cross-site scripting vulnerability (CVE-2021-23414) in video.js versions before 7.14.3 poses a potential security risk to web applications using this package. To mitigate this vulnerability, it is crucial to upgrade to video.js version 7.14.3 or later. Additionally, manually sanitizing the input provided to the src attribute of the track tag can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for video.js →
FAQ
video.js is an open-source JavaScript framework for building video players on the web. It provides a comprehensive set of features for video playback, including support for multiple video formats, customizable player controls, and integration with various video streaming platforms.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various security risks, such as stealing sensitive information, performing actions on behalf of the user, or manipulating the content of the web page.
The cross-site scripting vulnerability in video.js allows an attacker to inject and execute arbitrary JavaScript code in the context of the user's browser. This can lead to various security risks, such as stealing sensitive information, performing actions on behalf of the user, or manipulating the content of the web page.
To fix the cross-site scripting vulnerability in video.js, it is recommended to upgrade to version 7.14.3 or later. This version includes a fix for the vulnerability and ensures that the src attribute of the track tag is properly escaped, preventing the execution of arbitrary code.
If upgrading to the latest version of video.js is not immediately feasible, a temporary workaround is to manually sanitize the input provided to the src attribute of the track tag. This can be done by using a library or function that escapes special characters and prevents the execution of JavaScript code.
