CVE-2013-4170: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
6.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.57817%
CWE
Published
7/1/2022
Updated
8/29/2023
KEV Status
No
Technology
Ruby
RubyTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ember-source | rubygems | <= 1.0.0.rc1.0 | 1.0.0.rc1.1 |
| ember-source | rubygems | = 1.0.0.rc2.0 | 1.0.0.rc2.1 |
| ember-source | rubygems | = 1.0.0.rc3.0 | 1.0.0.rc3.1 |
| ember-source | rubygems | = 1.0.0.rc4.0 | 1.0.0.rc4.1 |
| ember-source | rubygems | = 1.0.0.rc5.0 | 1.0.0.rc5.1 |
| ember-source | rubygems | = 1.0.0.rc6.0 | 1.0.0.rc6.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from unsanitized use of the tagName property when creating view elements. Ember's View class uses tagName to generate the element via string interpolation in createElement. Since tagName wasn't sanitized in vulnerable versions, user-supplied values could inject malicious attributes (e.g., onerror). The patches likely added sanitization to this specific element creation path. While exact pre-patch code isn't shown, the advisory's description of the attack vector (binding to tagName) and XSS via innerHTML context strongly implicates the element creation function as the vulnerable point.