CVE-2016-10735

Overview

‍

Bootstrap is an HTML, CSS, and JS framework for developing responsive, mobile-first web sites and applications.

‍

A cross-site scripting (XSS) vulnerability (CVE-2016-10735) has been identified within the following Bootstrap 2 components:

• Tab
• Alert
• Collapse
• Dropdown
• Modal
• Carousel

‍

Per OWASP: Cross-Site Scripting attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. An attacker can use XSS to send a malicious script to an unsuspecting user.

‍

Details

Module Info

• Product: Bootstrap
• Affected packages: bootstrap
• Affected versions: >=2.0.0 <=2.3.2, >=3.0.0-rc1 <3.4.0, >=4.0.0-alpha <4.0.0-beta.2
• GitHub repository: https://github.com/twbs/bootstrap
• Published packages: https://npmjs.com/package/bootstrap
• Package manager: npm
• Fixed in: Bootstrap NES v2.3.5

‍

Vulnerability Info

The Medium-severity vulnerability is a result of improper handling of selectors passed in the data-target and href attributes, which could allow an attacker to inject malicious JavaScript code.

‍

The selector from the data-target or href attribute is used to reference which element to act upon. The affected code directly assigns the selector, trusting the input without validation or sanitization, leading to potential XSS attacks.

‍

Steps To Reproduce

1. Create an HTML page that is set up to use Bootstrap v2 and create an anchor element as a tooltip.
2. Change the data-target attribute to contain the following value: <img src='1' onerror='alert(1)' />
3. Click the ‘X’ to close the alert and observe the XSS fire.

Example:

<p>
  <a
    class="close"
    data-dismiss="alert"
    data-target="<img src=1 onerror=alert(123) />"
    href="#"
  >&times;</a
  >
</p>

‍

Credits

• Lpilorz (finder)

‍

Mitigation

The Bootstrap 2 version is End-of-Life and will not receive any updates to address this issue. For more information see here.

‍

Users of the affected components should apply one of the following mitigations:

• Migrate affected applications to a supported version of Bootstrap.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍