Cross-Site Scripting in AjaxNetProfessional

Vulnerability

Ajax.NET Professional (AjaxPro) versions before 21.12.22.1 are vulnerable to JavaScript object injection due to unsafe handling of JSON deserialization [1][2]. The flaw resides in the core JSON parsing logic that creates JavaScript objects from attacker-controlled input, potentially allowing injection of arbitrary client-side scripts [3]. The vulnerability affects all releases prior to 21.12.22.1 [1].

Exploitation

An attacker does not require authentication if the web application accepts untrusted JSON input through AjaxPro methods [1][2]. The attacker crafts a malicious JSON payload that, when parsed by the affected core.js component, creates a JavaScript object containing a malicious script [3]. This payload is then executed in the context of the victim's browser during normal application usage [3].

Impact

Successful exploitation results in cross-site scripting (XSS), enabling the attacker to execute arbitrary JavaScript in the victim's browser session [1][3]. This can lead to data theft, session hijacking, defacement, or redirection to malicious sites [3]. The attacker operates at the privilege level of the authenticated user if the application requires authentication [3].

Mitigation

The vulnerability is patched in version 21.12.22.1 [1][3][4]. Users should upgrade to this or a later version immediately [3]. For those unable to upgrade, a workaround exists that replaces the vulnerable core.js file embedded in the library via an XML configuration setting described in the GHSA advisory [1][3]. Administrators should validate the integrity of binary DLLs from NuGet, as unofficial packages may still contain the vulnerable code [3].