SB20261111119 - Multiple vulnerabilities in Form Plugin

Description

This security bulletin contains information about 3 vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in the context of an affected web page.

The vulnerability exists due to improper neutralization of user-controlled markup in the target response handling in src/jquery.form.js when the target option is configured without dataType and an application/json response is parsed into an array or object and passed to .html(). A remote attacker can supply a string containing a payload such as <img src=x onerror=alert(1)> through the JSON endpoint to execute arbitrary JavaScript when the response is inserted into the page.

The iframe transport is not affected because its response data remains a string.

2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in a victim's browser in the context of the affected page.

The vulnerability exists due to improper neutralization of input in the Form Plugin fileUploadIframe() function when constructing hidden inputs and an iframe by concatenating unescaped names and URLs into HTML strings. A remote attacker can supply a crafted extraData/data entry name or key, submit-button name, csrf-param meta-tag content, or iframeSrc value, such as the name payload "><img src=x onerror=alert()>, and induce a victim to submit the affected form to execute arbitrary JavaScript in the page.

The iframe transport is used when the iframe option is true or in very old browsers without the File API or FormData.

3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in a victim's browser in the context of the affected website.

The vulnerability exists due to improper neutralization of HTML in the Form Plugin resetForm() function when processing the for attribute of a label element. A remote attacker can supply a malicious attribute value such as <img src=x onerror=alert()> that is passed to jQuery's $() function without checking for HTML, causing arbitrary JavaScript to execute when the victim interacts with a page that invokes resetForm() on the affected label.

Remediation

Install update from vendor's website.

References

• https://github.com/jquery-form/form/security/advisories/GHSA-4w39-46xw-8jm2
• https://github.com/jquery-form/form/security/advisories/GHSA-x8mc-9vpg-2rc8
• https://github.com/jquery-form/form/security/advisories/GHSA-8395-7m7x-q7q2