Bug 1930915 (CVE-2021-20066) - CVE-2021-20066 jsdom: improper loading of local resources
Summary: CVE-2021-20066 jsdom: improper loading of local resources
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2021-20066
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1930916
TreeView+ depends on / blocked
 
Reported: 2021-02-19 19:08 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-08-31 09:04 UTC (History)
25 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-03-03 19:01:57 UTC
Embargoed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-02-19 19:08:44 UTC
JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.

Reference:
https://www.tenable.com/security/research/tra-2021-05

Comment 1 Mark Cooper 2021-02-23 00:43:38 UTC
External References:

https://www.tenable.com/security/research/tra-2021-05

Comment 4 Mark Cooper 2021-02-23 04:46:09 UTC
No upstream fix as the upstream maintainers do not agree this is a security issue.

From the report, https://www.tenable.com/security/research/tra-2021-05, yes the example works but I suppose it wasn't designed to load local resources? Prob not much of an issue from a client side perspective (maybe some scenarios where maybe some data could be leaked back to the server) but from a server perspective maybe if new JSDOM from source is using un-trusted input then feasible it could load server resources. 

BUT that is kinda what that function is designed to do, so I do understand where the maintainers are coming from here.

From an OCP and OSSM perspective, none of the components are enabling the loading of resources and are only using jsdom in a testing context. Hence they've been marked as Low, and wontfix.

Comment 6 Mark Cooper 2021-02-23 05:03:34 UTC
Statement:

For an application which includes jsdom to be vulnerable to this CVE, it must at least enable the loading of resources using something similar to: `new JSDOM(html, {resources: "usable"}`, where `html` is un-trusted input. Furthermore, scripts can be executed by extending the options similar to: `new JSDOM(html, {resources: "usable", runScripts: "dangerously"}`. [1]

OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM) both include components that package a vulnerable version of `jsdom`. However, none of the components directly enable the loading of resources via `resources: "usable"` and most components only include `jsdom` for use in tests. Hence for OCP and OSSM the affects are rated to have a Low impact and are wontfix at this time and might be fixed in a future release.

[1] https://github.com/jsdom/jsdom#loading-subresources

Comment 7 Product Security DevOps Team 2021-03-03 19:01:57 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20066


Note You need to log in before you can comment on or make changes to this bug.