CVE-2019-8331

Overview

‍

Bootstrap is an HTML, CSS, and JS framework for developing responsive, mobile-first web sites and applications.

‍

A cross-site scripting (XSS) vulnerability (CVE-2019-8331) has been identified within the Bootstrap 2 Tooltip and Popover components.

‍

Per OWASP: Cross-Site Scripting attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. An attacker can use XSS to send a malicious script to an unsuspecting user.

‍

Details

Module Info

• Product: Bootstrap
• Affected packages: bootstrap
• Affected versions: >=2.0.0 <=2.3.2, >=3.0.0-rc1 <3.4.1
• GitHub repository: https://github.com/twbs/bootstrap
• Published packages: https://npmjs.com/package/bootstrap
• Package manager: npm
• Fixed in: Bootstrap NES v2.3.5

‍

Vulnerability Info

The Medium-severity vulnerability is a result of improper sanitization of HTML content in the data-template and data-title attributes, which could allow an attacker to inject malicious JavaScript code.

The vulnerability exists because the affected code does not properly sanitize HTML content from the attributes before inserting it into the DOM, potentially allowing execution of malicious scripts through template injection, leading to potential XSS attacks.

‍

Steps To Reproduce

1. Create an HTML page that is set up to use Bootstrap v2 and create an anchor element as a tooltip.
2. Change the data-template attribute to contain the following value: <img src='1' onerror='alert(1)' />
3. Instantiate the tooltip with the .tooltip() function.
4. Hover over the button to fire the XSS.

Example:

<p>
  <a
    href="#"
    class="btn btn-large btn-danger"
    data-toggle="tooltip"
    title="This is title"
    data-content="this is content"
    data-template='<img src=1 onerror=alert(123) /></div></div>'
    >Hover to toggle tooltip</a
  >
</p>

<script>
  $(document).ready(function () {
    $('[data-toggle="tooltip"]').tooltip()
  })
</script>

Credits

• Yonatan Offek (poiu) (finder)

‍

Mitigation

The Bootstrap 2 version is End-of-Life and will not receive any updates to address this issue. For more information see here.

‍

Users of the affected components should apply one of the following mitigations:

• Migrate affected applications to a supported version of Bootstrap.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍