MathJax up to 2.7.3 \unicode{} cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in MathJax up to 2.7.3. This issue affects the function \unicode{}. Executing a manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2018-1999024. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in MathJax up to 2.7.3. This vulnerability affects the function \unicode{}. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.

The bug was discovered 04/03/2018. The weakness was shared 07/23/2018 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability was named CVE-2018-1999024 since 07/23/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability was handled as a non-public zero-day exploit for at least 111 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 2.7.4 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• MathJax

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3

License

• open-source

Website

• Product: https://github.com/mathjax/MathJax/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion