CVE-2013-7454 – validator

Package

Manager: npm
Name: validator
Vulnerable Version: >=0 <1.1.0

Severity

Level: Medium

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00655 pctl0.70041

Details

Multiple XSS Filter Bypasses in validator Versions of `validator` prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter. ## Proof of Concept Various inputs that could bypass the filter were discovered: Improper parsing of nested tags: ``` <s <onmouseover="alert(1)"> <;s onmouseover="alert(1)">This is a test</s> ``` Incomplete filtering of javascript: URIs: ``` <a href="javascriptJ a V a S c R iPt::alert(1)" "<s>">test</a> ``` UI Redressing: ``` <div style="z-index: 9999999; background-color: green; width: 100%; height: 100%"> <h1>You have won</h1>Please click the link and enter your login details: <a href="http://example.com/">http://good.com</a> </div> ``` Bypass via Nested Forbidden Strings: ``` <scrRedirecRedirect 302t 302ipt type="text/javascript">prompt(1);</scrRedirecRedirect 302t 302ipt> ``` Additional bypasses were discovered by Krzysztof Kotowicz in 2012 when auditing CodeIgniter's XSS filtering function, which this code was based off of. ## Recommendation If you are a developer currently using the xss filter function from the validator package, you should consider replacing it with the escape filter function from the same package. This function replaces all instances of angle brackets (<, >), ampersands, and quotation marks, so no HTML tags will be processed.

Metadata

Created: 2017-10-24T18:33:36Z
Modified: 2021-09-16T19:30:36Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-q4qq-fm7q-cwp5/GHSA-q4qq-fm7q-cwp5.json
CWE IDs: ["CWE-79"]
Alternative ID: GHSA-q4qq-fm7q-cwp5
Finding: F008
Auto approve: 1