Cross-site scripting in dojox - CVE-2019-10785

Vulnerability identifier: #VU25348

CSH Severity: Low

CVSS v4 BT: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear]

CVE-ID: CVE-2019-10785

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when "dojox.xmpp.util.xmlEncode" method only encodes the first occurrence of each character, not all of them. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

PoC:

"&&".replace("&", "&") == "&&"

dojox
IBM Cloud Pak System
IBM Security Guardium Key Lifecycle Manager (GKLM)
Financial Transaction Manager for ACH Services and Check Services
WebSphere eXtreme Scale
IBM Security Verify Governance
Tivoli Network Manager IP Edition
Ubuntu
dojo (Ubuntu package)
IBM Storage Scale System
IBM Qradar SIEM

Install updates from vendor's website.

dojox - addressed in versions 1.11.9, 1.12.7, 1.13.6, 1.14.5, 1.15.2, 1.16.1
IBM Cloud Pak System - update to 2.3.3.6
IBM Security Guardium Key Lifecycle Manager (GKLM) - update to 4.1.1 FP6
Tivoli Network Manager IP Edition - update to 4.2.0.20
dojo (Ubuntu package) - addressed in versions 1.10.4+dfsg-2ubuntu0.1~esm1, 1.15.0+dfsg1-1ubuntu0.1~esm1, 1.15.4+dfsg1-1ubuntu0.1
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
IBM Storage Scale System - addressed in versions 5.1.2.12, 5.1.8
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
WebSphere eXtreme Scale - update to 8.6.1.6 PH60890 iFix
IBM Security Verify Governance - update to 10.0.2.0.3

• https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr
• https://snyk.io/vuln/SNYK-JS-DOJOX-548257
• https://github.com/dojo/dojox/pull/315

• Cross-site scripting in dojox package for Dojo
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Cloud Pak System
• Mulitple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM WebSphere Extreme Scale
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM)
• Ubuntu update for dojo
• Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform