Vuln. Selector interpreted as HTML in JQuery script could kick up insecurity...

Viruses and worms
1

Where we detected it: Results from scanning URL: -https://www.security.nl/js/jquery/jquery.securitynl.js?13757912939
Number of sources found: 117
Number of sinks found: 55

Opening up inside the scan to:
Results from scanning URL: -https://gyve7.com/wp-content/cache/autoptimize/js/autoptimize_bbc575557b9a3c4176f9cda2406c9049.js *
Number of sources found: 41
Number of sinks found: 17

* Additional wp misconfigurations detected for -gyve7 dot com: User Enumeration The first two user ID's were tested to determine if user enumeration is possible.

ID User Login
1 None None
2 None gyve77
It is recommended to rename the admin user account to reduce the chance of brute force attacks occurring. As this will reduce the chance of automated password attackers gaining access. However it is important to understand that if the author archives are enabled it is usually possible to enumerate all users within a WordPress installation.
&
Directory Indexing
In the test an attempt was made to list the directory contents of the uploads and plugins folders to determine if Directory Indexing is enabled. This is a common information leakage vulnerability that can reveal sensitive information regarding your site configuration or content.

/wp-content/uploads/ enabled
/wp-content/plugins/ disabled
Directory indexing was tested on the /wp-content/uploads/ and /wp-content/plugins/ directores. Note that other directories may have this web server feature enabled, so ensure you check other folders in your installation. It is good practice to ensure directory indexing is disabled for your full WordPress installation either through the web server configuration or .htaccess.

We combine Vulnerability info with DOM XSS scan results here…:
Medium CVE-2012-6708 11290 Selector interpreted as HTML found up with Erlend Oftedal’s Retire.JS extension
with our DOM-XSS scanner result and see this flaw demonstrated here (one of 49 instances of Selector )
See: http://bugs.jquery.com/ticket/11290 & https://nvd.nist.gov/vuln/detail/CVE-2012-6708 & http://research.insecurelabs.org/jquery/test/

Example:

a.getElementsByTagName!="undefined"&&f.grep(a.getElementsByTagName("input"),bm)}function bm(a){if(a.type==="checkbox"||a.type==="radio")a.defaultChecked=a.checked}function bl(a){return typeof a.getElementsByTagName!="undefined"?a.getElementsByTagName("*"):typeof a.querySelectorAll!="undefined"?[i]a.querySelectorAll("*")[/i]:[]}function bk(a,b){var c;b.nodeType===1&&

[i][b]What the bug is telling you is that jQuery may mis-identify a selector (given here in italics) containing a < as being an HTML fragment instead, and try to parse and create the relevant elements.

So the vulnerability, such as it is, is that a cleverly-crafted selector, if then passed into jQuery, could define a script tag that then executes arbitrary script code in the context of the page, potentially taking private information from the page and sending it to someone with malicious (or merely prurient) intentions[/b][/i]. (info source StackOverflow)

It is important when flagged to retire such vulnerable jQuery libraries.
What one once has acquired, should also in time be retired.

Also it explains while linting and fuzzing going over code is a must.

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

2

Additional recommendations for security for that specific URL:

https://webhint.io/scanner/9215feb1-82f6-4460-9cbd-df029ea638ef#category-security
Response should include ‘x-content-type-options’ header. - twice.

Confirmation of Retire.JS scan results:
https://retire.insecurity.today/#!/scan/8b275aa71221cd88b9dd8b440b92ee96031aeb4d0d6e945bda30f615e8ad1a5d

For code

{
“indent_size”: “4”,
“indent_char”: " ",
“max_preserve_newlines”: “5”,
“preserve_newlines”: true,
“keep_array_indentation”: false,
“break_chained_methods”: false,
“indent_scripts”: “normal”,
“brace_style”: “collapse”,
“space_before_conditional”: true,
“unescape_strings”: false,
“jslint_happy”: false,
“end_with_newline”: false,
“wrap_line_length”: “0”,
“indent_inner_html”: false,
“comma_first”: false,
“e4x”: false,
“indent_empty_lines”: false
}
source: https://beautifier.io/

Also take good notion of the following SNYK resources, a vulnerability database for JQuery according to SNYK,
in various categories - Malcious Packages - Cross Site Scripting (XSS) - Arbitrairy Code Execution (a potential threat we discussed here in this thread) - Prototype Pollution, see: https://snyk.io/vuln/search?q=jQuery&type=any (combine any type with Maltiverse search queries to get to examples online of such insecurity). Analysts should dive into these questions more often :smiley:

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

3

L.S.

An example of combining the results of jQuery UI XSS vuln. inside SNYK’s vulnerability database,
Read: https://snyk.io/vuln/SNYK-DOTNET-JQUERYUICOMBINED-449591

This information combined with the results delivered through a Maltiverse Search for “jQuery UI”,
which is a resource for malcode researchers comes up with 3,975 results found for: “ jQuery UI ” within 912 ms.

Re: https://maltiverse.com/search;query=%20jQuery%20UI%20;page=1;sort=query_score

[i]So one absolutely as a researcher gets a better idea under which circumstances
and to what purposes such vulnerabilities can be abused.

This in order to be able to better protect against such flaws creating actual abuse.
Depending whether a patched version is available or when the vulnerabilty still exists,
other layers of security could help to protect (header security, validation on client and webserver side, etc.[/i]

Damian

P.S. Website developers and people that make use of JQuery libraries and also malware researchers and security consultants
should do more in the line of the practices demonstrated in this thread. This is absolutely vital to be able to come to a better and what is more important a more secure way of implementing JQuery library code to get a more secure website infrastructure.
Has been performed too little, too late and not to an extent that could really lead to making the Interwebz somewhat more secure.