Cross-site Scripting (XSS)

Vulnerability

Versions of bootstrap-table prior to 1.19.1 are vulnerable to Cross-site Scripting (XSS) due to a type confusion issue in the escapeHTML function [1]. When the input provided to escapeHTML is an array instead of a string, the sanitization is bypassed, even if the data-escape attribute is set to true [2]. The vulnerability exists in the utility function located in src/utils/index.js [1].

Exploitation

An attacker can exploit this vulnerability by supplying a JSON response via the data-url attribute where the affected field (e.g., name) contains an array of malicious HTML [2][3]. The PoC demonstrates setting data-escape="true" and providing a JSON object with an array value that includes a payload such as `` [2][3]. No additional authentication or user interaction is required beyond the victim accessing a page that loads the crafted JSON data into a bootstrap-table [2][3].

Impact

Successful exploitation allows an attacker to inject arbitrary JavaScript into the victim's browser context, leading to XSS. This could result in data theft, session hijacking, or other malicious actions performed in the context of the vulnerable web application [2][3].

Mitigation

The issue is fixed in bootstrap-table version 1.19.1 released on 22 September 2021 [2][3]. Users should upgrade to version 1.19.1 or later. There is no known workaround besides upgrading, as the type confusion is inherent to the sanitization logic [2][3].