CVE-2021-43862: jquery.terminal self XSS on user input
Summary
CVE-2021-43862: jquery.terminal self XSS on user input. Affects jquery.terminal versions < 2.31.1. Fixed in 2.31.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jquery.terminal is an npm package that provides a terminal emulator for web applications. It allows users to interact with the application through a command-line interface. The package is widely used and provides various features for formatting and executing commands. However, a vulnerability has been discovered in the package that allows for self XSS (Cross-Site Scripting) on user input.
Vulnerability Detail
The vulnerability in jquery.terminal allows an attacker to execute malicious JavaScript code on a victim's browser. This can be achieved by injecting the code into user input fields that are processed by the package. Although the injected code is visible to the victim, the attacker can use techniques to hide it. Additionally, if the application uses the execHash option to execute code from a URL, the attacker can exploit this to execute their code. The impact of this vulnerability is considered low, as the injected code is added to a span tag and does not automatically execute. However, it still poses a risk as the attacker can use other methods to deceive the victim.
The vulnerability has been assigned a CVSS score of 3.7, indicating a low severity level.
How To Fix
Minimum fixed version
2.31.1
This is the first release that contains the fix.
npm install jquery.terminal@2.31.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround can be implemented by using a specific formatting technique. The following code snippet demonstrates the workaround:
$.terminal.new_formatter([/([\s\S]+)/g, '[[;;]$1]']);
This workaround wraps the entire user input and renders it as a no-op. However, it should be noted that this workaround may not be effective if the application uses different formatters for highlighting code in a different way. Therefore, updating the package is still the recommended solution.
Conclusion
In conclusion, the jquery.terminal package is vulnerable to a self XSS vulnerability that allows an attacker to execute malicious JavaScript code on a victim's browser. The impact of this vulnerability is considered low, but it still poses a risk as the attacker can use other techniques to deceive the victim. To mitigate this vulnerability, it is recommended to update the package to version 2.31.1 or later. A workaround is available, but it may not be effective in all cases. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jquery.terminal →
FAQ
The impact of this vulnerability is considered low, as the injected code is visible to the victim and does not automatically execute. However, an attacker can use other techniques to hide the code from the victim, increasing the risk of exploitation.
No, the scope of code execution is limited to the injected code itself. The code is added to a span tag and does not automatically execute. However, an attacker can use other methods to deceive the victim and execute malicious code.
To fix this vulnerability, update the jquery.terminal package to version 2.31.1 or later. This version includes a patch that addresses the XSS vulnerability.
Yes, a workaround is available by using a specific formatting technique. However, the workaround may not be effective if the application uses different formatters for highlighting code in a different way. Updating the package is still the recommended solution.
For more information about this vulnerability, you can visit the GitHub issue https://github.com/jcubic/jquery.terminal/issues/727 or open an issue in the https://github.com/jcubic/jquery.terminal repository. You can also contact the developer at mailto:jcubic@onet.pl
References
Related vulnerabilities
Recent vulnerabilities recorded for jquery.terminal.
