Skip to main content
65 votes

Is it really Security Misconfiguration to show a version number?

The security impact of exposing the version number is that an attacker can instantly see whether your version is vulnerable to a known vulnerability. For example, jQuery before 3.4.0 is vulnerable to ...
Sjoerd's user avatar
  • 31.8k
45 votes
Accepted

What is meant by "Vulnerable with: css class selector" for JQuery?

In jQuery you can specify a CSS selector and HTML code with the same shorthand. This is a selector: $('#some-thing') This is HTML that gets evaluated immediately: $('<svg onload=alert(1)>') ...
Arminius's user avatar
  • 44.9k
37 votes

Is it really Security Misconfiguration to show a version number?

Knowing the version number is not a security misconfiguration. The risk of exposing version numbers is an "information disclosure". This can create a hazard if knowing this information equips an ...
schroeder's user avatar
  • 131k
12 votes

Is it really Security Misconfiguration to show a version number?

It is a very, very old pattern of thought in cybersecurity that exposing the version number of something is a security hazard. Allegedly, it makes the work easier for attackers, because if they know ...
Tom's user avatar
  • 10.6k
10 votes
Accepted

How to exploit publicy known vunerable version of jquery?

One important distinction to make here is that only because the jQuery library contains known vulnerabilities, it does not mean that the website is vulnerable to the contained vulnerability. As with ...
Denis's user avatar
  • 3,848
9 votes
Accepted

Is Content Security Policy only enforced during initial rendering?

Introduction CSP should be enforced by the browser as long as you stay on the page, and not just while it is originally loaded or rendered. Everything else would make it quite toothless. So the ...
Anders's user avatar
  • 65.7k
7 votes
Accepted

Is there a base version of jQuery which has no XSS vulnerability?

To get away from the reported issues, (which will show up via projects like retire JS), you'll need to use a JQuery version in the 3.x line. At least one of the commonly referenced issues (this one) ...
Rory McCune's user avatar
  • 62.4k
6 votes
Accepted

Is there a possability to inject XSS into the jQuery attr function?

What jQuery actually does when you use attr(name, value) is to call setAttribute(name, value) on the relevant DOM elements. Not at home in the jQuery source, but I think this is the relevant part. ...
Anders's user avatar
  • 65.7k
6 votes
Accepted

jquery.js Dynamic Code Evaluation: Code Injection on setTimeout() line

It's a false positive. Reporting false code injection vulnerabilities is a well-known problem with HP Fortify and has confused developers before. Fortify just does basic static analysis of the ...
Arminius's user avatar
  • 44.9k
6 votes
Accepted

Is jQuery 2.1.1 vulnerable to OS command injection?

It's a false positive. In both cases, the scanner only searched for "root:", assuming it is part of a passwd file. The line that is found is: root:function(a){return a===o} This is obviously not ...
tim's user avatar
  • 29.7k
6 votes
Accepted

Is there a way to exploit jquery 1.12.4 vulnerability?

It automatically executes JavaScript received on AJAX requests. Consider this example, which performs a GET request to a URL that the user can input. $.get($("input").val()) Now, if the user inputs ...
Sjoerd's user avatar
  • 31.8k
5 votes

How to audit JavaScript written by someone else before including it on my site?

One imperfect solution is to rely on reputation. Does the library have many users? Lots of downloads at GitHub or npm? An active community? Do any large established actors use it? A backdoor in jQuery ...
Anders's user avatar
  • 65.7k
5 votes
Accepted

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

This code snippet is vulnerable to XSS in jQuery prior to 1.9 (and in conjunction with the jQuery Migrate plugin). Even now, it remains at least a bad practice. The string argument to $() (shortcut ...
Arminius's user avatar
  • 44.9k
5 votes
Accepted

DOM Based XSS and Adding HTML Elements

Creating the DOM as string and using append or html indeed leads to DOM-based XSS. What you should do instead is to built the DOM elements using the proper functions and only inserting user-supplied ...
tim's user avatar
  • 29.7k
4 votes

Is jQuery 2.1.1 vulnerable to OS command injection?

No, JQuery is a client-side technology, which is really a wrapper for JavaScript for use within a web-browser only JavaScript doesn't have the capability to run OS commands when invoked by a browser, ...
SilverlightFox's user avatar
3 votes

Get MAC address of client using PHP, Angular js, jQuery/JavaScript

You don't understand what you are doing. All PHP code (and also the backtick/exec/system commands) is executed on the server. There is no portable/reliable way to get the MAC address. Maybe a browser ...
filo's user avatar
  • 293
3 votes

Adding Escaped HTML to DOM

The way to safely print untrusted data in HTML is by replacing HTML-significant characters with character entities. (That is, you'd replace < with &lt;, etc.) I suppose this is what you mean by ...
Arminius's user avatar
  • 44.9k
3 votes

Is XSS possible with jQuery(location.hash)?

Yes, it's possible to do something malicious with jQuery(window.location.hash). See this archived blog post which was mentioned in a comment to an answer in another SE question. A CSS timing attack ...
Jacob C.'s user avatar
  • 141
2 votes
Accepted

DOM based XSS: jQuery("#HiddenReferral").val(jQuery(location).attr('href'));

No, I don't think you can use it for XSS. Since the possibly unsafe object is passed to val() you should be fine. That function sets the value attribute. Whatever you set the value attribute to, you ...
Anders's user avatar
  • 65.7k
2 votes

How to handle 3rd party vulnerable code?

You can use subresource integrity. This prevents an attacker from altering scripts. It adds a hash to the script tag, and if that hash does not match with the script it does not get executed.
Sjoerd's user avatar
  • 31.8k
2 votes

Is XSS possible with jQuery(location.hash)?

As Goose’s answer mentions, it appears that there were some earlier versions of jQuery which were vulnerable to this. Since the jQuery function can convert strings into DOM elements like this... $('&...
Simon East's user avatar
2 votes
Accepted

jQuery $.get HTML code and XSS

If not user controlled, then it's not vulnerable to XSS. Someone somewhere must be able to inject script into data to make it vulnerable. appendTo isn't a sink in itself, however if it's appending ...
SilverlightFox's user avatar
2 votes

CSRF testing of an api endpoint using GET requests

As long as CORS is correctly configured, it is not possible to extract information from another domain via JavaScript. You should also check that your JSON endpoints return an object, and not an ...
Benoit Esnard's user avatar
2 votes

CSRF testing of an api endpoint using GET requests

As you started to mention, CSRF is only really useful for actions that change state, so this is not truly an example of CSRF. From OWASP: Cross-Site Request Forgery (CSRF) is an attack that ...
multithr3at3d's user avatar
2 votes
Accepted

Are jQuery vulnerabilities exposed by the file being served from the server of by usage of the vulnerable code?

When updating a library, you should indeed remove the (possibly problematic) code from the server. This is also true if the web application is not using the vulnerable parts of the library. There is ...
Tobi Nary's user avatar
  • 14.4k
2 votes

How to exploit publicy known vunerable version of jquery?

Further to Denis's excellent answer it is also worth clarifying that an attacker needs to be able to control the inputs to the vulnerable functions when a "victim's" machine is visiting the ...
El Ronnoco's user avatar
2 votes
Accepted

When signing up a new user, is there a way to secure the password using jQuery/PHP?

There's not really anything else major you can do. There's a few minor things, which I'll get to, but the basic pattern you describe is used near-universally for good reason. Just based on the steps ...
CBHacking's user avatar
  • 49.5k
2 votes

How to prevent XSS attack on selected window.location in javascript

Create the URL using the JavaScript URL API. dest = new URL("Default.aspx", window.location); dest.searchParams.append("uId", selecteduserId); window.location = dest.href; This ...
Sjoerd's user avatar
  • 31.8k
1 vote

Are jQuery vulnerabilities exposed by the file being served from the server of by usage of the vulnerable code?

It depends on the vulnerability. For example, a XSS vulnerability is client-side only. As long as you stop including a vulnerable version of the library on your pages, your site won't be vulnerable, ...
Benoit Esnard's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible