Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade to jQuery version 3.5.0 or above #17272

Closed
ghost opened this issue Feb 25, 2021 · 7 comments
Closed

Upgrade to jQuery version 3.5.0 or above #17272

ghost opened this issue Feb 25, 2021 · 7 comments
Labels
answered For when a question was asked and we referred to forum or answered it. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org.

Comments

@ghost
Copy link

ghost commented Feb 25, 2021

Summary

jQuery version 2.2.4 has an XSS vulnerability.

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

See CVE-2020-11022 for details.

Your Environment

  • Matomo Version: 4.1.1
  • PHP Version: 7.4.7
  • Server Operating System: Amazon Linux
  • Additionally installed plugins: none
@ghost ghost added the Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. label Feb 25, 2021
@sgiehl
Copy link
Member

sgiehl commented Feb 25, 2021

Thanks for creating the issue. We haven't yet update jQuery as it caused problems with our Wordpress plugin. Once we have solved it I guess we will update it at least in the next major release. See matomo-org/matomo-for-wordpress#314

Also I'm note sure if those vulnerabilities apply for Matomo (if you have a proof of concept for any of them in Matomo, it would be great if you could report it to https://matomo.org/security/).

@ghost
Copy link
Author

ghost commented Feb 25, 2021

I don't know if the XSS is really applicable for Matomo, it's very likely that it's not. It just popped up in a pentest report and I wanted to let you know. It was classified as an unverified medium level issue, so it's not a dealbreaker for us.

@tsteur
Copy link
Member

tsteur commented Feb 25, 2021

FYI we applied the recommended patch for this one in 3aeb55f#diff-c1ed6b08f25739fbcb946deed857f1b4a1aaaf560af98a8e7256fecf129fa967R8 . I'm quite certain we can close this one?

@tsteur
Copy link
Member

tsteur commented Mar 19, 2021

closing this one for now as the fix is already applied

@tsteur tsteur closed this as completed Mar 19, 2021
@tsteur tsteur added not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. answered For when a question was asked and we referred to forum or answered it. labels Mar 19, 2021
@Findus23 Findus23 mentioned this issue May 12, 2021
Closed
@MatomoForumNotifications
Copy link

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/jquery-vulnerability-in-latest-matamo/46861/2

@heurteph-ei
Copy link

@tsteur, I don't understand: you wrote:

closing this one for now as the fix is already applied

But in https://demo.matomo.cloud/index.php if you open the browser console, then type:

jQuery().jquery

you'll get:

"2.2.4"

@sgiehl
Copy link
Member

sgiehl commented Aug 3, 2022

@heurteph-ei The title of this issue didn't match the description. The description was more related to a XSS issue in jQuery 2.2.4.
That XSS vulnerability has been fixed by applying a patch. We didn't update jQuery yet.

@heurteph-ei heurteph-ei mentioned this issue Aug 17, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
answered For when a question was asked and we referred to forum or answered it. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@tsteur @sgiehl @heurteph-ei @MatomoForumNotifications