XSS scripting in bootstrap <3.3.7

[pbr0ck3r]

Expected Behavior

Don't allow XSS.

Current Behavior

Bootstrap 3.3.7 is are vulnerable to Cross-Site Scripting (XSS) attacks via the data-target attribute.
https://snyk.io/vuln/npm:bootstrap:20160627
Fixed in: twbs/bootstrap#23687

Possible Solution

• Update to bootstrap 4.0.0 or version 3.4.0 when it is released (currently in dev).

Steps to Reproduce (for bugs)

Context

• Security Vulnerability

Your Environment

• Graylog Version: 2.4.3
• Elasticsearch Version: 6.1.2
• MongoDB Version: 3.6.2
• Operating System: Mac OS High Seirra
• Browser version: Firefox/Chrome

[dennisoelkers]

Thanks for reporting this, @pbr0ck3r. Is this an issue that is actually affecting us or is this a theoretical issue because we use an affected dependency but not in a way that allows exploitation of the issue?

[pbr0ck3r]

It does not directly affect graylog core code base. But is a theoretical issue. If anyone where to have a plugin containing similar to the following code pointing to a malicious site, or scraping data.

<button data-toggle="collapse" data-target="<img src=x onerror=alert(0)>">Test</button>

It is suggested to update bootstrap to fix this vulnerability.

[joschi]

@pbr0ck3r Thanks for providing these details!

Right now, we're blocked until Bootstrap 3.4.0 has been released: twbs/bootstrap#25679