CVE-2021-41184: Vulnerability in Drupal - jQuery-UI
Summary
CVE-2021-41184: XSS in the of option of the .position() util. Affects drupal across 3 version ranges.
>= 7.0.0, < 7.86.0
>= 9.2.0, < 9.2.11
>= 9.3.0, < 9.3.3
Fixed in 7.86.0, 9.2.11 or 9.3.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-41184 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The vulnerability affects the jQuery-UI library used by Drupal. jQuery-UI is an official jQuery user interface library that provides various interactive components and effects. The library is vulnerable to code execution when accepting untrusted values for the of option of the .position() utility. This vulnerability can be exploited by attackers to execute arbitrary code on the affected Drupal site.
Vulnerability Detail
The vulnerability in jQuery-UI arises from accepting untrusted values for the of option of the .position() utility. Prior to version 1.13.0, any string value passed to the of option was not properly sanitized, allowing for the execution of untrusted code. This could lead to various consequences, such as remote code execution, data leakage, or unauthorized access to sensitive information. The issue has been fixed in jQuery UI 1.13.0, where any string value passed to the of option is now treated as a CSS selector, mitigating the risk of code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.86.07.86.0 -
>= 9.2.0, < 9.2.119.2.11 -
>= 9.3.0, < 9.3.39.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Drupal installation is not immediately feasible, a workaround is to avoid accepting the value of the of option from untrusted sources. By carefully validating and sanitizing the input for the of option, the risk of code execution can be mitigated. For example, instead of directly accepting user input, the of option can be hardcoded to a trusted value or limited to a predefined set of options.
Conclusion
The vulnerability in Drupal's jQuery-UI library can allow for the execution of untrusted code. It is crucial to update the affected Drupal installation to a version that includes the patched jQuery UI library. This will mitigate the risk of code execution and ensure the security of the Drupal site. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for drupal →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications.
jQuery-UI is the official jQuery user interface library. It offers various interactive components and effects for web development.
The of option in jQuery UI's .position() utility specifies the element or selector to position an element relative to.
The vulnerability can lead to code execution, enabling attackers to execute arbitrary code on the affected Drupal site. This can result in various consequences, such as remote code execution, data leakage, or unauthorized access to sensitive information.
To fix this vulnerability, update the affected Drupal installation to a version that includes the fixed jQuery UI library. Refer to the 'how_to_fix' section for specific version recommendations.
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
