CVEs-PoC/2020/CVE-2020-11023.md

CVE-2020-11023

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

POC

Reference

• http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.tenable.com/security/tns-2021-02
• https://www.tenable.com/security/tns-2021-10

Github

• https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023
• https://github.com/ARPSyndicate/cvemon
• https://github.com/AssassinUKG/JS_Encoder
• https://github.com/AssassinUKG/XSSPlayground
• https://github.com/Cybernegro/CVE-2020-11023
• https://github.com/DanielRuf/snyk-js-jquery-565129
• https://github.com/EdgeSecurityTeam/Vulnerability
• https://github.com/EmptyHeart5292/jQuery-XSS
• https://github.com/SexyBeast233/SecBooks
• https://github.com/Snorlyd/https-nj.gov---CVE-2020-11023
• https://github.com/alphaSeclab/sec-daily-2020
• https://github.com/andreassundstrom/cve-2020-11023-demonstration
• https://github.com/arijitdirghangi/100DaysofLearning
• https://github.com/arijitdirghanji/100DaysofLearning
• https://github.com/ctcpip/jquery-security
• https://github.com/cve-sandbox/jquery
• https://github.com/faizhaffizudin/Case-Study-Hamsa
• https://github.com/goelp14/Hacky-Holidays-2020-Writeups
• https://github.com/johnrearden/strings_attached
• https://github.com/marksowell/retire-html-parser
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/octane23/CASE-STUDY-1
• https://github.com/soosmile/POC
• https://github.com/spurreiter/jquery
• https://github.com/tzwlhack/Vulnerability