CVE-2022-31160: jQuery UI - XSS Vulnerability when Refreshing Checkboxradio
Summary
CVE-2022-31160: jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label. Affects jquery-ui versions < 1.13.2. Fixed in 1.13.2. How to fix ↓
Also tracked for
- jqueryui · Debian:11
The same CVE-2022-31160 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jQuery UI is a popular open-source JavaScript library that provides a set of user interface interactions, effects, widgets, and themes for web applications. It is widely used to enhance the user experience and improve the visual appeal of websites. However, a vulnerability has been discovered in jQuery UI that allows for cross-site scripting (XSS) attacks when refreshing a checkboxradio with an HTML-like initial text label.
Vulnerability Detail
The vulnerability arises when initializing a checkboxradio widget on an input enclosed within a label. In this scenario, the parent label contents are considered as the input label. If the widget is refreshed using the .checkboxradio( "refresh" ) method and the initial HTML contains encoded HTML entities, they will be erroneously decoded. This can potentially lead to the execution of arbitrary JavaScript code. An attacker could exploit this vulnerability by injecting malicious code into the initial HTML label, which would then be executed when the widget is refreshed. The impact of this vulnerability can range from unauthorized data disclosure to full control of the affected user's session.
How To Fix
Minimum fixed version
1.13.2
This is the first release that contains the fix.
npm install jquery-ui@1.13.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If changing the initial HTML is possible, a workaround for this vulnerability is to wrap all the non-input contents of the label in a span element. By doing so, the encoded HTML entities will not be decoded when the widget is refreshed. Here's an example of the modified HTML:
<label>
<input id="test-input">
<span><img src=x onerror="alert(1)"></span>
</label>
Conclusion
The XSS vulnerability in jQuery UI when refreshing a checkboxradio with an HTML-like initial text label can have serious security implications. It is crucial to update the jQuery UI dependency to version 1.13.2 or later to mitigate this vulnerability. Additionally, developers should consider implementing the provided workaround if modifying the initial HTML is feasible. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jquery-ui →
FAQ
jQuery UI is a JavaScript library that provides a collection of user interface interactions, effects, widgets, and themes for web applications. It is widely used to enhance the visual appeal and functionality of websites.
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized data disclosure or the execution of arbitrary JavaScript code in the context of the affected user's session.
To fix the vulnerability, update your jQuery UI dependency to version 1.13.2 or later. This can be done by updating the package.json file or using the package manager command specific to your project's package manager (e.g., npm, yarn).
Yes, a workaround is available. If you can modify the initial HTML, wrap all the non-input contents of the label in a span element. This prevents the encoded HTML entities from being decoded when the widget is refreshed.
You can find more information about this vulnerability in the jQuery UI repository on GitHub. Search for relevant issues or open a new issue if you have any specific questions or comments.
References
Related vulnerabilities
Recent vulnerabilities recorded for jquery-ui.
