GHSA-6qqj-rx4w-r3cj

Source

https://github.com/advisories/GHSA-6qqj-rx4w-r3cj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-6qqj-rx4w-r3cj/GHSA-6qqj-rx4w-r3cj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6qqj-rx4w-r3cj

Published

2020-08-31T22:48:44Z

Modified

2021-09-23T19:45:13Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

CSRF Vulnerability in jquery-ujs

Details

Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains.

When an attacker controls the href attribute of an anchor tag, or the action attribute of a form tag triggering a POST action, the attacker can set the href or action to " https://attacker.com". By prepending a space to the external domain, it causes jQuery to consider it a same origin request, resulting in the user's CSRF token being sent to the external domain.

Recommendation

Upgrade jquery-ujs to version 1.0.4 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-352"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:07:52Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / jquery-ujs

Package

Name: jquery-ujs; View open source insights on deps.dev
Purl: pkg:npm/jquery-ujs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.4

Database specific

last_known_affected_version_range

"<= 1.0.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-6qqj-rx4w-r3cj/GHSA-6qqj-rx4w-r3cj.json"