Cross-site scripting in Form Plugin - #VU165526

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript in a victim's browser in the context of the affected page.

The vulnerability exists due to improper neutralization of input in the Form Plugin fileUploadIframe() function when constructing hidden inputs and an iframe by concatenating unescaped names and URLs into HTML strings. A remote attacker can supply a crafted extraData/data entry name or key, submit-button name, csrf-param meta-tag content, or iframeSrc value, such as the name payload "><img src=x onerror=alert()>, and induce a victim to submit the affected form to execute arbitrary JavaScript in the page.

The iframe transport is used when the iframe option is true or in very old browsers without the File API or FormData.

Affected software

Remediation

External References

• https://github.com/jquery-form/form/security/advisories/GHSA-x8mc-9vpg-2rc8

Related Security Bulletins

• Multiple vulnerabilities in Form Plugin