0

i searched no-stop for a lot of time trying to see how the publicy known "Vulnerable version of the library jquery" can be exploit to make proof of concepts to website owners.

Let's say we have The library jquery version 2.1.1 that has known security issues.

if you search for it in internet you get that is vulnerable to XSS and another attack... but i can't find anywhere how to actually exploit the xss or any type of known issues... i want to be able to test it myself.

edit: what do i have to look for? where do i have to test?

  • Where are you getting the "Vulnerable version of the library jquery" term from? An article? A vulnerabiliti scanner? Can you provide more information on where this is coming from? – Aura Apr 27 at 4:25
3

One important distinction to make here is that only because the jQuery library contains known vulnerabilities, it does not mean that the website is vulnerable to the contained vulnerability.

As with many libraries, a website using jQuery will only be affected by a vulnerability if it uses the vulnerable function in vulnerable way. If it does not use the functionality at all, the issues will not be exploitable. They might become exploitable if the used functionality on the website changes.

Looking for example at the mentioned jQuery 2.1.1. This version is, according to the site http://research.insecurelabs.org/jquery/test/ vulnerable to

  • jQuery issue 2432 - 3rd party $.get() auto executes if content type is text/javascript
  • jQuery issue 11974 - parseHTML executes inline scripts like event handlers

The first issue (https://github.com/jquery/jquery/issues/2432) can be exploited only if the vulnerable site uses $.get() for a URL that returns a response that can be influenced by you. If you cannot control the URL or the content, only a theoretical threat exists. The website owner of the site where the URL points could theoretically execute a XSS attack against the site that uses the vulnerable jQuery version in the mentioned way.

The second issue (https://bugs.jquery.com/ticket/11974) can only be exploited if the website uses the function $.parseHTML() and you can influence the input to that function. If is does not use the function in the described way, you cannot exploit the issue.

To wrap things up:
If you see the message "Vulnerable version of the library jquery" you will have to look at the JavaScript code that is actually used by the website and identify if it uses the vulnerable functions in a way that can be exploitet by you. If it doesn't, you cannot create a proof of concept exploit or exploit the vulnerability.

  • wow what a clear answer!! so if i find a vunerable jquery i would have to look at the functions and identify if i can control de url or content, and then to the second issue if i can influence the input to change the function. thanks buddy!! – Tomi Begher Apr 27 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.