Bug 1136683 (CVE-2014-6071)
| Summary: | CVE-2014-6071 jQuery: cross-site scripting flaw | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Murray McAllister <mmcallis> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abaron, aortega, apevec, ayoung, bdunne, bkearney, bleanhar, cbillett, ccoleman, chrisw, cpelland, dajohnso, dallan, dclarizi, dmcphers, gkotton, gmccullo, jdetiber, jfrey, jialiu, jkeck, jokajak, jokerman, jorton, jprause, jrafanie, jstribny, jvlcek, katello-bugs, kseifried, lhh, lmacken, lmeyer, lpeer, markmc, mburns, mmaslano, mmccomas, mmccune, mmcgrath, mrunge, obarenbo, peter.borsa, rbean, rbryant, rhos-maint, sclewis, sdodson, shawn, tjay, tomckay, vdanen, vondruch, xlecauch, yeylon |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-09-04 04:44:56 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1136684 | ||
|
Description
Murray McAllister
2014-09-03 05:07:11 UTC
It looks likely that this issue is not an issue at all, but investigations are still ongoing. The proof of concept in the full disclosure post is not an exploit that can be run against a target as it suggests. What it is in fact is a known bad-pattern with jquery where using text() inside after() can lead to DOM based XSS. For something to be vulnerable, they would have to follow this anti-pattern in a website that used jquery. While this is still possible to get arbitary html into a page following this pattern with the current version of jquery, and the jquery documentation specifically states: [from http://api.jquery.com/after/] " By design, any jQuery constructor or method that accepts an HTML string — jQuery(), .append(), .after(), etc. — can potentially execute code. This can occur by injection of script tags or use of HTML attributes that execute code (for example, <img onload="">). Do not use these methods to insert strings obtained from untrusted sources such as URL query parameters, cookies, or form inputs. Doing so can introduce cross-site-scripting (XSS) vulnerabilities. " Jquery 1.6 and up (several years old now) actually added specific hardening that looks to block <script> tags. CVE-2014-6071 was assigned for this report. Statement: Red Hat Product Security determined that this flaw was not a security vulnerability. See the Bugzilla link for more details. |