Coordinated Disclosure Timeline

Summary

Potential mXSS in Zepto.JS

Product

Zepto.JS

Tested Version

Latest vulnerable version: 1.2.0 (master, b5ed8d607f67724788ec9ff492be297f64d47dfc)

Details

Potential mXSS

jQuery’s htmlPrefilter functionality is considered unsafe as of CVE-2020-11022, see additional details here: GHSA-gxr4-xjj5-5px2. The problem was that htmlPrefilter enabled new mXSS attacks when expanding self-closing tags (<tag/>). This function will apply a regular expression to convert <tag/> into <tag></tag>:

rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([a-z][^\/\0>\x20\t\r\n\f]*)[^>]*)\/>/gi
 ...

htmlPrefilter: function( html ) {
    return html.replace( rxhtmlTag, "<$1></$2>" );
    return html;
}

If developers sanitize untrusted HTML (e.g.: using DOMPurify) and then pass the clean HTML into this filter (e.g.: when calling jQuery()), the resulting HTML may mutate into dangerous HTML. For example, the following image tag with two string literal attributes:

<img alt="<x" title="/><img src=url404 onerror=alert(0)>">

will mutate into:

<img alt="<x" title="></x"><img src=url404 onerror=alert(0)>">

Additional attack vectors can be found in jQuery tests.

Note that while some of these test-strings seem suspicious, they will not actually cause code to be run unless they are transformed by the unsafe htmlPrefilter.

Zepto contains a port of jQuery’s htmlPrefilter functionality, and is vulnerable to some of the same attack vectors. See this example which will show an alert:

<html>
  <head>
    <script type="text/javascript" src="./zepto.js"></script></head>
  <body>
    <script type="text/javascript">
      $.zepto.fragment('<noscript/><img src=url404 onerror=alert(0)>')
    </script>
  </body>
</html>

Impact

This issue may lead to a Cross-Site Scripting vulnerability (mXSS)

Credit

This issue was discovered by Esben Sparre Andreasen (@esbena) performing a Variant Analysis of CVE-2020-11022 which was found and reported by Masato Kinugawa (@masatokinugawa).

Contact

You can contact the GHSL team at securitylab@github.com, please include GHSL-2020-098 in any communication regarding this issue.