Hot answers tagged

64

The security impact of exposing the version number is that an attacker can instantly see whether your version is vulnerable to a known vulnerability. For example, jQuery before 3.4.0 is vulnerable to CVE-2019-11358, so it is useful information for an attacker to know whether your jQuery is 3.3.9 or 3.4.1. However, with JavaScript that runs in the browser ...


36

Knowing the version number is not a security misconfiguration. The risk of exposing version numbers is an "information disclosure". This can create a hazard if knowing this information equips an attacker to craft an exploit for a vulnerability in that specific version. Even if the library ends up containing a vulnerability, it is still not a security ...


11

It is a very, very old pattern of thought in cybersecurity that exposing the version number of something is a security hazard. Allegedly, it makes the work easier for attackers, because if they know the version of whatever it is you are running, they can look up the vulnerabilities that apply to that version. Actually, that is what security scanners are ...


3

This does not work. The browser has to be able to read the link, and as soon as the browser is able to do that, the user is able to do that.


3

One important distinction to make here is that only because the jQuery library contains known vulnerabilities, it does not mean that the website is vulnerable to the contained vulnerability. As with many libraries, a website using jQuery will only be affected by a vulnerability if it uses the vulnerable function in vulnerable way. If it does not use the ...


2

There's not really anything else major you can do. There's a few minor things, which I'll get to, but the basic pattern you describe is used near-universally for good reason. Just based on the steps you describe, if somebody were to have their credentials compromised, I would very strongly suspect it to have nothing to do with your HTTPS or password handling,...


2

It automatically executes JavaScript received on AJAX requests. Consider this example, which performs a GET request to a URL that the user can input. $.get($("input").val()) Now, if the user inputs https://sakurity.com/jqueryxss, jQuery will recognize that as being JavaScript (because of the content type header) and execute it automatically. Executing ...


1

You would maybe be able to do it if the charset was not atypical, and then you may be able to get a valid result by using a multibyte character converting into an equals sign, but you can't change the charset yourself as it will probably appear in the server response header, or default to UTF-8. In Section 12.1.2.1-3 of the HTML standards, tags have to be ...


1

Yes, it's possible to do something malicious with jQuery(window.location.hash). See this archived blog post which was mentioned in a comment to an answer in another SE question. A CSS timing attack can be done, as was described in the blog post: If we execute the selector *:has(:has(:has(*)) :has(*) :has(*)) input[name=authenticity_token][value^='x'], it ...


Only top voted, non community-wiki answers of a minimum length are eligible