2

I am trying to see how a publicly known "vulnerable version of the library jquery" can be exploited to make proof of concepts to website owners.

Let's say we have jquery version 2.1.1 that has known security issues.

If you search for it, you get that is vulnerable to XSS and another attack. But I can't find anywhere how to actually exploit the xss or any type of known issues. I want to be able to test it myself.

What do I have to look for? Where do I have to test?

0

2 Answers 2

10

One important distinction to make here is that only because the jQuery library contains known vulnerabilities, it does not mean that the website is vulnerable to the contained vulnerability.

As with many libraries, a website using jQuery will only be affected by a vulnerability if it uses the vulnerable function in a vulnerable way. If it does not use the functionality at all, the issues will not be exploitable. They might become exploitable if the used functionality on the website changes.

Looking for example at the mentioned jQuery 2.1.1. This version is, according to the site http://research.insecurelabs.org/jquery/test/ vulnerable to

  • jQuery issue 2432 - 3rd party $.get() auto executes if content type is text/javascript
  • jQuery issue 11974 - parseHTML executes inline scripts like event handlers

The first issue (https://github.com/jquery/jquery/issues/2432) can be exploited only if the vulnerable site uses $.get() for a URL that returns a response that can be influenced by you. If you cannot control the URL or the content, only a theoretical threat exists. The website owner of the site where the URL points could theoretically execute an XSS attack against the site that uses the vulnerable jQuery version in the mentioned way.

The second issue (https://bugs.jquery.com/ticket/11974) can only be exploited if the website uses the function $.parseHTML() and you can influence the input to that function. If it does not use the function in the described way, you cannot exploit the issue.

To wrap things up:
If you see the message "Vulnerable version of the library jquery" you will have to look at the JavaScript code that is actually used by the website and identify if it uses the vulnerable functions in a way that can be exploited by you. If it doesn't, you cannot create a proof of concept exploit or exploit the vulnerability.

1
  • wow what a clear answer!! so if i find a vunerable jquery i would have to look at the functions and identify if i can control de url or content, and then to the second issue if i can influence the input to change the function. thanks buddy!! Commented Apr 27, 2019 at 14:41
2

Further to Denis's excellent answer it is also worth clarifying that an attacker needs to be able to control the inputs to the vulnerable functions when a "victim's" machine is visiting the site.

If, for example, there is a textbox on a webpage and when the user hits "Submit" the contents of that textbox is used as an argument to the $.get() function - that isn't an exploit per se, because the attacker is just executing the vulnerable function on their own machine.

A common attack scenario is a forum-style site where attackers can post content which is then rendered on other visitors' machines (e.g. you are currently reading my content rendered on your machine) - if part of the site's operation involves taking that content, or parts of that content, and passing it into vulnerable functions, then there you have a potential exploit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .