CVE-2021-41182 PoC — XSS in the `altField` option of the Datepicker widget

Source

https://github.com/aredspy/CVE-2021-41182-Tester

Associated Vulnerability

Title:XSS in the `altField` option of the Datepicker widget (CVE-2021-41182)
Description:jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

Description

Some test files to make a good nuclei template for a JQuery UI XSS vuln

File Snapshot


 [4.0K]  /data/pocs/6a138197a76ded7d8c520b7f10c606134afa4b9f
├── [1.7K]  CVE-2021-41182.yaml
├── [3.0K]  index.html
├── [4.0K]  jquery-ui-1.12.1
│   ├── [ 12K]  AUTHORS.txt
│   ├── [4.0K]  external
│   │   └── [4.0K]  jquery
│   │       └── [287K]  jquery.js
│   ├── [4.0K]  images
│   │   ├── [6.8K]  ui-icons_444444_256x240.png
│   │   ├── [6.9K]  ui-icons_555555_256x240.png
│   │   ├── [4.6K]  ui-icons_777620_256x240.png
│   │   ├── [6.8K]  ui-icons_777777_256x240.png
│   │   ├── [4.5K]  ui-icons_cc0000_256x240.png
│   │   └── [6.2K]  ui-icons_ffffff_256x240.png
│   ├── [ 32K]  index.html
│   ├── [ 36K]  jquery-ui.css
│   ├── [509K]  jquery-ui.js
│   ├── [ 31K]  jquery-ui.min.css
│   ├── [248K]  jquery-ui.min.js
│   ├── [ 18K]  jquery-ui.structure.css
│   ├── [ 15K]  jquery-ui.structure.min.css
│   ├── [ 18K]  jquery-ui.theme.css
│   ├── [ 14K]  jquery-ui.theme.min.css
│   ├── [1.8K]  LICENSE.txt
│   └── [1.8K]  package.json
└── [4.0K]  jquery-ui-1.13.3
    ├── [ 14K]  AUTHORS.txt
    ├── [4.0K]  external
    │   └── [4.0K]  jquery
    │       └── [279K]  jquery.js
    ├── [4.0K]  images
    │   ├── [7.0K]  ui-icons_444444_256x240.png
    │   ├── [6.9K]  ui-icons_555555_256x240.png
    │   ├── [4.5K]  ui-icons_777620_256x240.png
    │   ├── [7.0K]  ui-icons_777777_256x240.png
    │   ├── [4.5K]  ui-icons_cc0000_256x240.png
    │   └── [6.4K]  ui-icons_ffffff_256x240.png
    ├── [ 32K]  index.html
    ├── [ 37K]  jquery-ui.css
    ├── [517K]  jquery-ui.js
    ├── [ 31K]  jquery-ui.min.css
    ├── [249K]  jquery-ui.min.js
    ├── [ 18K]  jquery-ui.structure.css
    ├── [ 15K]  jquery-ui.structure.min.css
    ├── [ 18K]  jquery-ui.theme.css
    ├── [ 14K]  jquery-ui.theme.min.css
    ├── [1.8K]  LICENSE.txt
    └── [2.1K]  package.json

8 directories, 40 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!