JS XSS Vulnerability in Wire UI Package: Exploitable via Button Label Parameter
Summary
CVE-2024-45803: Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content. Affects wireui/wireui across 2 version ranges.
< 1.19.3
>= 2.0.0, < 2.1.3
Fixed in 1.19.3 or 2.1.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wire UI is a popular package used for building user interfaces in PHP applications, particularly those utilizing the Laravel framework. It provides a set of components that enhance the user experience by offering customizable UI elements. However, a significant security flaw has been identified in the '/wireui/button' endpoint, which allows for the injection of malicious JavaScript through the 'label' query parameter, compromising the integrity of applications using this package.
Vulnerability Detail
A Cross-Site Scripting (XSS) vulnerability exists in the '/wireui/button' endpoint due to inadequate sanitization of user input in the 'label' query parameter. Attackers can exploit this vulnerability by crafting a URL that includes a script tag, allowing arbitrary JavaScript code to be executed in the context of the victim's browser. This could lead to severe consequences, including session hijacking, user impersonation, phishing attacks, and content manipulation. The vulnerability is particularly concerning as it can be exploited without any authentication, making it accessible to any user who can access the endpoint.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.19.31.19.3composer require wireui/wireui:1.19.3 -
>= 2.0.0, < 2.1.32.1.3composer require wireui/wireui:2.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, developers can implement input validation on the server side to reject any requests that include script tags or other potentially harmful content in the 'label' parameter. For example, a simple validation check could be added to filter out any input containing '<script>' tags:
if (strpos($label, '<script>') !== false) {
// Reject the input or sanitize it
$label = 'Invalid input';
}
Conclusion
The identified XSS vulnerability in the Wire UI package poses a significant risk to applications that utilize the '/wireui/button' endpoint. By updating to the latest versions and implementing robust input validation, developers can mitigate the risks associated with this vulnerability. Regular monitoring with tools like Vulert can further enhance security by providing real-time alerts for open-source vulnerabilities.
See every vulnerability recorded for wireui/wireui →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) flaw that allows attackers to inject and execute arbitrary JavaScript code through the 'label' parameter in the '/wireui/button' endpoint.
If your application uses the Wire UI package and allows user input in the 'label' parameter for the '/wireui/button' endpoint, it may be vulnerable. You can check for vulnerabilities using tools like Vulert.
Exploitation of this vulnerability can lead to session hijacking, unauthorized actions on behalf of users, phishing attacks, and manipulation of the application's content.
Update the Wire UI package to version 1.19.3 or 2.1.3 or later, and ensure proper input validation and sanitization are implemented in your application.
Yes, you can use Vulert to monitor your application for open-source vulnerabilities in real-time. It analyzes your composer.lock file to alert you of any issues.
