Critical Code Execution Vulnerability in jQuery UI Datepicker

Background

jQuery UI is a popular user interface library built on top of jQuery, providing a set of interactions, effects, widgets, and themes. The Datepicker widget allows users to select dates from a calendar interface. However, prior to version 1.13.0, the Datepicker widget was vulnerable to accepting untrusted input for various *Text options, which could lead to the execution of untrusted code, posing a significant security risk.

Vulnerability Detail

The vulnerability, identified as CVE-2021-41183, arises from the Datepicker widget's handling of input values for its *Text options. If these values are sourced from untrusted inputs, it may allow an attacker to execute arbitrary code. This can lead to unauthorized actions being performed on behalf of the user, data leakage, or even complete system compromise. The issue was addressed in jQuery UI version 1.13.0, where the library was updated to treat these values as plain text rather than HTML.

sudo apt-get install --only-upgrade jqueryui

Workaround

As a temporary workaround, avoid accepting values for the *Text options of the Datepicker widget from untrusted sources. This can be implemented by validating and sanitizing any user input before it is passed to the Datepicker options. For example, you can use the following code snippet to ensure that only safe values are accepted:

function safeInput(input) {
    // Implement your validation logic here
    return input.replace(/<[^>]*>/g, ''); // Simple HTML tag removal
}

$('#datepicker').datepicker({
    onSelect: function(dateText) {
        var safeDate = safeInput(dateText);
        // Use safeDate for further processing
    }
});

Conclusion

CVE-2021-41183 is a significant vulnerability in jQuery UI's Datepicker widget that can lead to code execution through untrusted input. It is crucial to update to version 1.13.0 or later to mitigate this risk. Implementing input validation can serve as a temporary measure while updates are being planned.

See every vulnerability recorded for jqueryui →

FAQ