CVE-2018-9113 (JavaScript, published 2018-04-26T06:29Z)
Description: value: Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial '><script type="text/javascript" src=' line. Fix released on 2018-03-29.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/CDCgov/MicrobeTrace
Files changed:
components/files.html
index.html
index.js
package.json
scripts/common.js
yarn.lock
Commit message: Filtered for XSS attacks properly



Vulnerable code:
      var headers = output.meta.fields.map(app.striptags);
      $('#reference').val(app.striptags(app.parseFASTA(e.target.result)[0].seq));
          node.id = app.striptags(node.id);
          node.seq = app.striptags(node.seq);
              link[key] = app.striptags(link[key]);
            key = app.striptags(key);
            node = JSON.parse(app.striptags(JSON.stringify(node)));
            key = app.striptags(key);
              nodeIDs = row.map(app.striptags);
      drawthresholdHistogram();
      drawthresholdHistogram();
  function drawthresholdHistogram(){
    svg.append("g")
        .attr("class", "axis axis--x")
        .attr("transform", "translate(0," + height + ")")
        .call(d3.axisBottom(x));

      range = max - min;
  }
  <script type="text/javascript" src="vendor/bootstrap-filestyle.min.js"></script>
  <script type="text/javascript" src="node_modules/html2canvas/dist/html2canvas.min.js"></script>
  <script type="text/javascript" src="node_modules/screenfull/dist/screenfull.js"></script>
  <script type="text/javascript" src="node_modules/d3/dist/d3.min.js"></script>
  <script type="text/javascript" src="node_modules/plotly.js/dist/plotly.min.js"></script>
const express = require('express')
const PORT = process.env.PORT || 5000
  .listen(PORT, () => console.log(`Listening on ${ PORT }`))
    "appcache": "./appcache.sh",
    "express": "^4.16.3",
    "vue": "^2.5.16"
app.striptags = function(inp){
  return ('' + inp)
    .replace(/<[^>]+?>.*?<\/[^>]+?>/g, '') //Closed Tags
    .replace(/<[^>]+?\/\s*>/g, '') //Self-Closing Tags
    .replace(/<[^>]+?>/g, ''); //Unclosed Tags
};

async@^1.5.2, async@~1.5:
  version "1.5.2"
  resolved "https://registry.yarnpkg.com/async/-/async-1.5.2.tgz#ec6a61ae56480c0c3cb241c95618e20892f9672a"

colors@1.0.3:
  version "1.0.3"
  resolved "https://registry.yarnpkg.com/colors/-/colors-1.0.3.tgz#0433f44d809680fdeb60ed260f1b0c262e82a40b"

corser@~2.0.0:
  version "2.0.1"
  resolved "https://registry.yarnpkg.com/corser/-/corser-2.0.1.tgz#8eda252ecaab5840dcd975ceb90d9370c819ff87"

ecstatic@^3.0.0:
  version "3.2.0"
  resolved "https://registry.yarnpkg.com/ecstatic/-/ecstatic-3.2.0.tgz#1b1aee1ca7c6b99cfb5cf6c9b26b481b90c4409f"
  dependencies:
    he "^1.1.1"
    mime "^1.4.1"
    minimist "^1.1.0"
    url-join "^2.0.2"

eventemitter3@1.x.x:
  version "1.2.0"
  resolved "https://registry.yarnpkg.com/eventemitter3/-/eventemitter3-1.2.0.tgz#1c86991d816ad1e504750e73874224ecf3bec508"

he@^1.1.1:
  version "1.1.1"
  resolved "https://registry.yarnpkg.com/he/-/he-1.1.1.tgz#93410fd21b009735151f8868c2f271f3427e23fd"

http-proxy@^1.8.1:
  version "1.16.2"
  resolved "https://registry.yarnpkg.com/http-proxy/-/http-proxy-1.16.2.tgz#06dff292952bf64dbe8471fa9df73066d4f37742"
  dependencies:
    eventemitter3 "1.x.x"
    requires-port "1.x.x"

http-server@^0.11.1:
  version "0.11.1"
  resolved "https://registry.yarnpkg.com/http-server/-/http-server-0.11.1.tgz#2302a56a6ffef7f9abea0147d838a5e9b6b6a79b"
  dependencies:
    colors "1.0.3"
    corser "~2.0.0"
    ecstatic "^3.0.0"
    http-proxy "^1.8.1"
    opener "~1.4.0"
    optimist "0.6.x"
    portfinder "^1.0.13"
    union "~0.4.3"

mime@^1.4.1:
  version "1.6.0"
  resolved "https://registry.yarnpkg.com/mime/-/mime-1.6.0.tgz#32cd9e5c64553bd58d19a568af452acff04981b1"

minimist@~0.0.1:
  version "0.0.10"
  resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.0.10.tgz#de3f98543dbf96082be48ad1a0c7cda836301dcf"

mkdirp@0.5.x, mkdirp@^0.5.0:
opener@~1.4.0:
  version "1.4.3"
  resolved "https://registry.yarnpkg.com/opener/-/opener-1.4.3.tgz#5c6da2c5d7e5831e8ffa3964950f8d6674ac90b8"

optimist@0.6.x:
  version "0.6.1"
  resolved "https://registry.yarnpkg.com/optimist/-/optimist-0.6.1.tgz#da3ea74686fa21a19a111c326e90eb15a0196686"
  dependencies:
    minimist "~0.0.1"
    wordwrap "~0.0.2"

portfinder@^1.0.13:
  version "1.0.13"
  resolved "https://registry.yarnpkg.com/portfinder/-/portfinder-1.0.13.tgz#bb32ecd87c27104ae6ee44b5a3ccbf0ebb1aede9"
  dependencies:
    async "^1.5.2"
    debug "^2.2.0"
    mkdirp "0.5.x"

qs@~2.3.3:
  version "2.3.3"
  resolved "https://registry.yarnpkg.com/qs/-/qs-2.3.3.tgz#e9e85adbe75da0bbe4c8e0476a086290f863b404"

requires-port@1.x.x:
  version "1.0.0"
  resolved "https://registry.yarnpkg.com/requires-port/-/requires-port-1.0.0.tgz#925d2601d39ac485e091cf0da5c6e694dc3dcaff"

union@~0.4.3:
  version "0.4.6"
  resolved "https://registry.yarnpkg.com/union/-/union-0.4.6.tgz#198fbdaeba254e788b0efcb630bc11f24a2959e0"
  dependencies:
    qs "~2.3.3"

url-join@^2.0.2:
  version "2.0.5"
  resolved "https://registry.yarnpkg.com/url-join/-/url-join-2.0.5.tgz#5af22f18c052a000a48d7b82c5e9c2e2feeda728"

wordwrap@~0.0.2:
  version "0.0.3"
  resolved "https://registry.yarnpkg.com/wordwrap/-/wordwrap-0.0.3.tgz#a3d5da6cd5c0bc0008d37234bbaf1bed63059107"


Fixed code:
      var headers = output.meta.fields.map(filterXSS);
      $('#reference').val(filterXSS(app.parseFASTA(e.target.result)[0].seq));
          node.id = filterXSS(node.id);
          node.seq = filterXSS(node.seq);
              link[key] = filterXSS(link[key]);
            key = filterXSS(key);
            node = JSON.parse(filterXSS(JSON.stringify(node)));
            key = filterXSS(key);
              nodeIDs = row.map(filterXSS);
      session.updateThresholdHistogram();
      session.updateThresholdHistogram();
  session.updateThresholdHistogram = function(){
          .html(null)
          range = max - min;
  };
  <script type="text/javascript" src="node_modules/xss/dist/xss.min.js"></script>
  <script type="text/javascript" src="node_modules/d3/dist/d3.min.js"></script>
  <script type="text/javascript" src="node_modules/plotly.js/dist/plotly.min.js"></script>
  <script type="text/javascript" src="node_modules/html2canvas/dist/html2canvas.min.js"></script>
  <script type="text/javascript" src="node_modules/screenfull/dist/screenfull.js"></script>
  <script type="text/javascript" src="vendor/bootstrap-filestyle.min.js"></script>
#!/usr/bin/env node

const express = require('express');
  .listen(process.env.PORT || 5000);
    "appcache": "sh appcache.sh",
    "express": "^4.16.3",
    "vue": "^2.5.16",
    "xss": "^0.3.7"
async@~1.5:
  version "1.5.2"
  resolved "https://registry.yarnpkg.com/async/-/async-1.5.2.tgz#ec6a61ae56480c0c3cb241c95618e20892f9672a"

cssfilter@0.0.10:
  version "0.0.10"
  resolved "https://registry.yarnpkg.com/cssfilter/-/cssfilter-0.0.10.tgz#c6d2672632a2e5c83e013e6864a42ce8defd20ae"

mkdirp@^0.5.0:
xss@^0.3.7:
  version "0.3.7"
  resolved "https://registry.yarnpkg.com/xss/-/xss-0.3.7.tgz#1df6dc85c0240b455b5e5f0428bdeccd739ab4ee"
  dependencies:
    commander "^2.9.0"
    cssfilter "0.0.10"