Outdated Bootstrap Library Contains Script Injection Weakness

Vulnerability Explanation

Bootstrap's Affix plugin accepts a `target` configuration option that specifies a scroll target element. In versions before 3.4.0, this value is passed directly to the jQuery `$()` constructor without sanitisation. Because jQuery's `$()` will parse and execute HTML strings, an attacker who can control the `target` value (e.g., via a URL parameter, user-supplied data, or a DOM-based injection point) can pass a crafted HTML payload such as `<img src=x onerror=alert(1)>` to trigger arbitrary JavaScript execution in the victim's browser. The fix in 3.4.0 changed the lookup to use `$(document).find(this.options.target)` for non-default values, which only performs a DOM query and does not parse raw HTML.

Root Cause

The Affix plugin passed the user-supplied `target` option directly to the jQuery `$()` constructor, which treats string arguments beginning with `<` as HTML to be parsed and injected into the DOM. No input sanitisation or allowlist validation was applied to this configuration value before use.

Technical Impact

An attacker who can influence the Bootstrap Affix `target` configuration value can execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session token theft, credential harvesting via fake UI overlays, or redirection to malicious sites. Scope is changed (browser context crosses component boundary), but both confidentiality and integrity impact are rated Low by NVD, as exploitation requires user interaction and the ability to influence the configuration value.

Severity Justification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — Network-reachable, low complexity, but requires user interaction and attacker influence over the affix target configuration. Not in CISA KEV. EPSS ~0.12, indicating low observed exploitation in the wild.

Affected Components

• bootstrap (npm) < 3.4.0
• bootstrap-sass (npm/RubyGems) < 3.4.0
• org.webjars:bootstrap (Maven) < 3.4.0
• twbs/bootstrap (Composer) < 3.4.0
• bootstrap (NuGet) < 3.4.0

Remediation Steps

1. Upgrade Bootstrap to version 3.4.0 or later. This is the official fix — the affix plugin's target lookup was patched in this release.
2. If loading Bootstrap via CDN, update the `<script>` tag src to reference v3.4.0+. Example: `https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js`
3. If managing Bootstrap via a package manager, run the appropriate upgrade command (see code examples below) and commit the updated lock file.
4. Search your codebase for any `.affix({` calls that pass a `target` value sourced from user input or URL parameters, and ensure those values are validated against a strict allowlist of known safe CSS selectors.
5. Consider migrating to Bootstrap 5, which removes the Affix plugin entirely — eliminating this vulnerability class from your codebase.

Verification Steps

1. After upgrading, confirm the loaded Bootstrap version in your browser's DevTools console: `$.fn.tooltip.Constructor.VERSION` should return `3.4.0` or higher.
2. Inspect your HTML source or network requests to confirm no old Bootstrap 3.x JS file (e.g., `bootstrap-3.1.1.min.js`) is still being loaded from a CDN or local path.
3. Run your dependency audit tool again: `npm audit`, `bundle audit`, or `mvn dependency-check:check` — CVE-2018-20677 should no longer appear.
4. If you use a sub-resource integrity (SRI) hash on your CDN script tag, regenerate it for the new version using https://www.srihash.org/

Code Examples (bash / html)

<!-- CDN: vulnerable -->
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.1.1/js/bootstrap.min.js"></script>

# npm
npm install bootstrap@3.1.1

# Maven (pom.xml)
<dependency>
  <groupId>org.webjars</groupId>
  <artifactId>bootstrap</artifactId>
  <version>3.1.1</version>
</dependency>

<!-- CDN: patched -->
<script
  src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js"
  integrity="sha384-ZDqB0sXyMEMkamFMeX4FKQP5/3tGo3RKMfn+QMnMFkFJMRmECa8zHDNxDMRCpK"
  crossorigin="anonymous"></script>

# npm
npm install bootstrap@^3.4.1

# Maven (pom.xml)
<dependency>
  <groupId>org.webjars</groupId>
  <artifactId>bootstrap</artifactId>
  <version>3.4.1</version>
</dependency>

Best Practices

• Never pass unsanitised user-controlled data as jQuery selector strings or Bootstrap plugin configuration values.
• Pin frontend library versions in your package manager and use `npm audit` or equivalent in your CI pipeline to catch known CVEs before they reach production.
• Implement a Content Security Policy (CSP) header as a defence-in-depth layer — it can limit the damage of any XSS that does execute by restricting script sources.
• When evaluating third-party library upgrades, check whether the new version removes deprecated or historically vulnerable features (like Bootstrap's Affix plugin) rather than just patching them.

References

• nvd.nist.gov/vuln/detail/CVE-2018-20677
• github.com/twbs/bootstrap/issues/27045
• github.com/twbs/bootstrap/pull/27047
• osv.dev/vulnerability/GHSA-ph58-4vrj-w6hr
• blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/