New Bootstrap Vulnerabilities to Watch

As defined by the Open Worldwide Application Security Project (OWASP), a cross-site scripting (XSS) attack is a vector by which a malicious script is injected into a website. These can be relatively trivial, and just inject new content or data into the website — or more nefarious, and transmit data, like session login information, to a third party under the attacker’s control.   

Some examples of what can be accomplished via an XSS attack: 

• Form contents could be sent to a third party instead of the site, leading to leakage of PII or financial information. 

• A link could submit a form to a malicious site, returning data that the browser than assumes is trusted, but in fact contains and executes additional malicious code. 

• A session cookie could be hijacked and used by the attacker to gain access to the user session and data on the website. The attacker can now impersonate the user and gain access to their information, which might include PII or payment methods. If the user has admin privileges on the website, the attacker could gain access to administration tools, potentially changing any content on the site. 

• A script could modify site contents, such as a press release or blog post, providing false information to consumers and damaging the credibility of the site owner. 

There are a number of general measures you can take to mitigate XSS attacks. The most basic is to validate all user input, and use robust sanitization and normalization measures when rendering user-provided input to prevent script injection from occurring in the first place. Additionally, you can set things such as HttpOnly cookies, which prevents JavaScript from accessing cookies, and add Content Security Policy HTTP headers, which prevents third-party JavaScript.  

However, when using third-party JavaScript frameworks such as Bootstrap, sometimes you cannot audit every bit of JS that your application executes.  

In those cases, you can apply your own patch or migrate to the current version of Bootstrap, Bootstrap 5. If neither of those are possible, it is recommended to get long-term support through a commercial partner like OpenLogic so that you have access to patches when vulnerabilities affecting EOL versions are disclosed. OpenLogic has patched all three of these CVEs for our Bootstrap LTS customers.  

Final Thoughts

Once open source software reaches end of life, vulnerabilities become harder to deal with since you can't rely on the community to provide a fix quickly. As described above, the fallout from XSS attacks can be somewhat minor (false information/vandalism to your site) or devastating (sensitive customer data stolen), so if you are running an older version of Bootstrap, it's time to upgrade or make sure you have an LTS provider. 

Additional Resources

• Datasheet - Bootstrap Long-Term Support and Services 
• Blog - Using Bootstrap: Tips for Getting Started
• Blog - Bootstrap Framework Basics
• Video - EOL Software Risks
• Blog - Introducing Bootstrap LTS from OpenLogic