CVE-2022-1330: Cross-site Scripting in fullpage.js
Summary
CVE-2022-1330: Cross-site Scripting in fullpage.js. Affects fullpage.js versions < 4.0.5. Fixed in 4.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fullpage.js is an npm package that allows developers to create full-screen scrolling websites. It provides a simple and easy-to-use API for creating sections, slides, and navigation. However, a vulnerability has been discovered in fullpage.js that allows for cross-site scripting (XSS) attacks. When an anchor tag is created using fullpage.js and an unsanitized URL is added as the href attribute, it can lead to the execution of malicious code in the context of the anchor element.
Vulnerability Detail
The vulnerability arises from the lack of URL sanitization in fullpage.js. By injecting a specially crafted URL, an attacker can execute arbitrary JavaScript code in the victim's browser. This can lead to various consequences, including session hijacking, defacement of the website, or theft of sensitive information. The vulnerability has been assigned a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.0.5
This is the first release that contains the fix.
npm install fullpage.js@4.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the URLs before adding them as href attributes. This can be done using a library or custom code that performs URL encoding and validation. Here's an example of how to sanitize a URL using the 'sanitize-html' library in Node.js:
const sanitizeHtml = require('sanitize-html');
const sanitizedUrl = sanitizeHtml(url, {
allowedTags: [],
allowedAttributes: {}
});
Conclusion
In conclusion, the fullpage.js package is vulnerable to cross-site scripting (XSS) attacks due to the lack of URL sanitization. Developers should update their package to the latest version or apply a temporary workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fullpage.js →
FAQ
fullpage.js is an npm package that simplifies the creation of full-screen scrolling websites. It provides an API for creating sections, slides, and navigation.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code and various consequences, such as session hijacking or data theft.
The vulnerability in fullpage.js allows attackers to inject and execute malicious scripts on your website. This can lead to unauthorized access, defacement, or theft of sensitive information.
Yes, a fix is available for this vulnerability. Developers should update their fullpage.js package to version 4.0.5 or later, which includes proper URL sanitization to prevent XSS attacks.
Yes, a temporary workaround can be implemented by manually sanitizing the URLs before adding them as href attributes. This can be done using a library or custom code that performs URL encoding and validation.
References
Related vulnerabilities
Recent vulnerabilities recorded for fullpage.js.
