JavaScript execution via malicious molfiles (XSS)
Moderate severity
GitHub Reviewed
Published
Apr 13, 2021
in
ipb-halle/MolecularFaces
•
Updated Jan 9, 2023
Description
Reviewed
Apr 13, 2021
Published to the GitHub Advisory Database
Apr 16, 2021
Last updated
Jan 9, 2023
Impact
The viewer plugin implementation of
<mol:molecule>renders molfile data directly inside a<script>tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.Patches
Patched in v0.3.0: Molfile data is now rendered as value of a hidden
<input>tag and escaped via JSF's mechanisms.Workarounds
No workaround available.
References