Highchartsに脆弱性、ブレッドクラムの設定経由で任意のスクリプトを実行されるおそれ
Summary
Highcharts Coreには、チャートの設定を操作できる攻撃者がブレッドクラムの設定にイベントハンドラーを仕込めるクロスサイトスクリプティングの脆弱性があります。影響を受けるのは10.0.0から11.4.9未満、12.6.1未満、13.1.0未満の版です。利用中の版を11.4.9、12.6.1、13.1.0以降の修正版に更新してください。スタイルモードのチャートは影響を受けません。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Highcharts Coreには、チャートの設定を操作できる攻撃者がブレッドクラムの設定にイベントハンドラーを仕込めるクロスサイトスクリプティングの脆弱性があります。影響を受けるのは10.0.0から11.4.9未満、12.6.1未満、13.1.0未満の版です。利用中の版を11.4.9、12.6.1、13.1.0以降の修正版に更新してください。スタイルモードのチャートは影響を受けません。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| highcharts | highcharts | — | — |
| npm | highcharts |
≥ 13.0.0, < 13.1.0 |
13.1.0 |
Original description The description as published by the source.
Impact
The breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live handlers on the breadcrumb button, so the attacker's script runs in the origin of the page hosting the chart. The option is reached through drilldown.breadcrumbs, navigation.breadcrumbs and the breadcrumbs option of the treemap, sunburst and treegraph series. Exploitation requires that untrusted data reach the chart configuration and that a user drill down, or traverse into a level of a hierarchical series, so that the breadcrumbs render, and then hover over or activate the breadcrumb button. Charts rendered in styled mode do not apply the option and are not affected. Charts built with Highcharts Stock, Maps and Gantt are included, since those ship from the same package as Core.
Workarounds
Verified against published bundles on 10.0.0, 11.4.8, 12.3.0 and 13.0.2.
Load immediately after Highcharts, before any chart is created:
// Workaround fix for all affected Highcharts versions: 10.0.0-13.0.2
((H)=>{const S=H.SVGElement.prototype,D=S._defaultSetter;S._defaultSetter=function _defaultSetter(v,k,e){/^on/i.test(k)||D.call(this,v,k,e)};})(Highcharts);
// End of the workaround fix
Obtaining the patched version
The patched releases are available from all the…
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com