CVE-2021-41184
MEDIUMjQuery UI < 1.13.0 - Cross-Site Scripting via Position Utility 'of' Option
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2021-41184. PoCs published by gabrielolivra, CoderDias.
AI-analyzed exploit summary This PoC demonstrates a Cross-Site Scripting (XSS) vulnerability in jQuery UI v1.12.1 via the `of` option in the `.position()` utility. The exploit injects malicious HTML through the `of` parameter, triggering XSS when the position method is called.
Description
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
Exploits (2)
This PoC demonstrates a Cross-Site Scripting (XSS) vulnerability in jQuery UI v1.12.1 via the `of` option in the `.position()` utility. The exploit injects malicious HTML through the `of` parameter, triggering XSS when the position method is called.
This repository contains a functional proof-of-concept for CVE-2021-41184, demonstrating an XSS vulnerability in jQuery-UI versions prior to 1.13.0. The exploit leverages the untrusted `of` option in the `.position()` utility to execute arbitrary JavaScript code via a crafted HTML string.
References (15)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N