Description
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AmauriC | tarteaucitron.js | 1.20.1 – < 1.37.0 | 1.37.0 |
References
- https://github.com/AmauriC/tarteaucitron.js/commit/068653bd47f5d4a493251ca8e15bd2b0be9b544f patch
- tarteaucitron.js v1.37.0 Release Notes release-notes
- https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2641-L2648 technical-description
- https://github.com/AmauriC/tarteaucitron.js/compare/v1.36.0...v1.37.0 technical-description
- VulnCheck Advisory: tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch third-party-advisory