Cross-site Scripting (XSS) Affecting validator package, versions <1.1.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.
Start learning- Snyk IDnpm:validator:20130705-2
- published5 Jul 2013
- disclosed5 Jul 2013
- creditNeal Poole, Krzysztof Kotowicz
Introduced: 5 Jul 2013
CVE-2013-7451 (opens in a new tab)How to fix?
If you are a developer currently using the xss filter function from the validator package, you should consider replacing it with the escape filter function from the same package. This function replaces all instances of angle brackets (<, >), ampersands, and quotation marks, so no HTML tags will be processed.
Overview
The validator module for Node.js contains functionality meant to filter potential XSS attacks (a filter called xss). Several ways to bypass the filter were discovered. In general, because the function’s filtering is blacklist-based it is likely that other bypasses will be discovered in the future. Developers are encouraged not to use the xss filter function in this package.
Source: Node Security Project
Details
Various inputs that could bypass the filter were discovered:
Improper parsing of nested tags:
<s <onmouseover="alert(1)"> <;s onmouseover="alert(1)">This is a test</s>
Incomplete filtering of javascript: URIs:
<a href="javascriptJ a V a S c R iPt::alert(1)" "<s>">test</a>
UI Redressing:
<div style="z-index: 9999999; background-color: green; width: 100%; height: 100%">
<h1>You have won</h1>Please click the link and enter your login details:
<a href="http://example.com/">http://good.com</a>
</div>
Bypass via Nested Forbidden Strings:
<scrRedirecRedirect 302t 302ipt type="text/javascript">prompt(1);</scrRedirecRedirect 302t 302ipt>
Additional bypasses were discovered by Krzysztof Kotowicz in 2012 when auditing CodeIgniter's XSS filtering function, which this code was based off of.
Details
<>