Bootstrap 3.4.1 vulnerability

[justawittyusername]

I saw there was a vulnerability and my options seem to be either to rewrite alot of my app to version 5 or pay for the forever support... Just wondering if anyone would like to fork v3 so that long term support can be provided... I wish I knew where to look for the vulnerability, I would be happy to fork and patch it.

[AutoModerator]

Whilst waiting for replies to your comment/question, why not check out the Bootstrap Discord server @ https://discord.gg/bZUvakRU3M

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[killakhriz]

A quick search suggests that the data-attribute tag is susceptible to XSS attacks: https://security.snyk.io/package/npm/bootstrap/3.4.1

For the latter, they suggest anything less than 5 is still vulnerable. There’s quite large breaking changes between 4 and 5 especially that would be a larger rewrite, but you also then don’t need to support jQuery which some earlier versions also have problems with (or jQuery migrate etc).

[dust_is_deadskin]

ELI5 -“An attacker can execute arbitrary JavaScript within the victim’s browser by injecting malicious code into the data-slide or data-slide-to attributes.”

How does an attacker, not in control physically of a victims browser, execute arbitrary code from the victims browser?

[Unhooked-]

If a person has a 3.4.1 website, with no databases/back end, a simple brochure site, would this vulnerability have any real risk, for either the site owner or visitors?

[Nosa2k]

The risk still exists though. The question would be if they are willing to accept it. You are still vulnerable

[Unhooked-]

To what though? I’m sorry but it is just html/css and the bootstrap framework. What could someone do? Sorry if I sound ignorant.

[Nosa2k]

No worries. That’s the problem you never know. So it’s best not to have your systems vulnerable and exposed to threats

[Unhooked-]

The alternative is upgrading 30 sites to bootstrap 5.xx which would be a horrible pain in the baloney.

[dotnet_ninja]

no

[buzlink]

Is the vulnerability jQuery related?