CVE-2020-11023 in jquery
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Affected software: jquery, debian linux, fedoraproject fedora, drupal, oracle application express, oracle application testing suite, oracle banking enterprise collections, oracle banking platform, oracle blockchain platform, oracle business intelligence
Scores
- CVSS: 6.1 (medium)
- EPSS: 84.89% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2025-01-23
- Published: 2020-04-29
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade jQuery to 3.5.0 or later (CVE-2020-11023)
Patch or upgrade. jQuery before 3.5.0 can run untrusted HTML containing option elements as script when passed to DOM manipulation methods. jQuery 3.5.0 fixes the htmlPrefilter behaviour.
Applies to: jQuery 1.0.3 up to 3.4.1.
- Find every web application that bundles jQuery (look for jquery*.js in the web roots or package.json).
- Upgrade jQuery to 3.5.0 or later and run the jQuery Migrate plugin to find code that depends on the old behaviour.
- If an application cannot be upgraded, sanitise untrusted HTML with a library such as DOMPurify before passing it to .html(), .append() and similar methods.
- Ask vendors of off-the-shelf web applications for a release with jQuery 3.5.0 or later.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.