Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-11004

CVE-2019-11004: Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation

6.1

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-11004
GHSA ID
GHSA-rg3q-jxmp-pvjj
EPSS Score
0.47673%
CWE
CWE-79
Published
4/9/2019
Updated
8/28/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
materialize-cssnpm<= 1.0.0
@materializecss/materializenpm< 1.1.0-alpha1.1.0-alpha

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the Toast component's handling of the 'html' parameter. The pre-patch code in js/toasts.js directly assigned user-provided HTML to toast.innerHTML (via this.message = options.html). The commit introduced 'text' and 'unsafeHTML' options, deprecated 'html', and added warnings about sanitization. The explicit replacement of 'html' with safer alternatives in the patch confirms this was the XSS vector. The CVE description and GitHub advisory specifically reference the Toast feature as the attack surface.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In M*t*ri*liz* t*rou** *.*.*, XSS is possi*l* vi* t** To*st ***tur*.

Reasoning

T** vuln*r**ility st*ms *rom t** To*st *ompon*nt's **n*lin* o* t** '*tml' p*r*m*t*r. T** pr*-p*t** *o** in `js/to*sts.js` *ir**tly *ssi*n** us*r-provi*** *TML to `to*st.inn*r*TML` (vi* t*is.m*ss*** = options.*tml). T** *ommit intro*u*** 't*xt' *n* 'u