CVE-2021-29489: Highcharts JS XSS Vulnerability

CVE-2021-29489 Overview

CVE-2021-29489 is a Cross-Site Scripting (XSS) vulnerability in Highcharts JS, a popular JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors, allowing content from untrusted sources to execute arbitrary code in end users' browsers.

Critical Impact

Attackers can inject malicious scripts through unsanitized chart options, potentially stealing user credentials, session tokens, or performing actions on behalf of authenticated users.

Affected Products

• Highcharts JS (versions 8 and earlier)
• NetApp Cloud Backup
• NetApp OnCommand Insight
• NetApp OnCommand Workflow Automation
• NetApp SnapCenter

Discovery Timeline

• 2021-05-05 - CVE-2021-29489 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-29489

Vulnerability Analysis

This vulnerability exists because the Highcharts JS library did not implement systematic filtering of XSS vectors within its chart options structure. When applications allow users or untrusted sources to supply chart configuration options, malicious JavaScript code can be injected and subsequently executed in the context of the victim's browser session.

The attack requires user interaction (such as viewing a page containing a malicious chart) and low privileges to exploit. Once executed, the injected script can access cookies, session tokens, and other sensitive information stored in the browser, or perform unauthorized actions on behalf of the user.

Root Cause

The root cause of CVE-2021-29489 is insufficient input sanitization in the Highcharts options parsing mechanism. The library accepted and processed chart configuration objects without adequately validating or sanitizing string values that could contain executable JavaScript code. This includes options that accept HTML content, SVG attributes, or callback functions where malicious payloads could be embedded.

Attack Vector

The attack vector is network-based, requiring an attacker to inject malicious content into chart options that are then rendered by the Highcharts library. Exploitation scenarios include:

The attacker can craft malicious chart configuration data containing JavaScript payloads within string properties such as labels, tooltips, or titles. When the target application renders a chart using these tainted options, the malicious script executes in the victim's browser context.

Due to the changed scope characteristic of this vulnerability, a successful attack can impact resources beyond the vulnerable component itself, potentially affecting the broader web application security context.

Detection Methods for CVE-2021-29489

Indicators of Compromise

• Unexpected JavaScript execution when rendering Highcharts visualizations
• Unusual network requests originating from pages containing Highcharts components
• Client-side errors or console warnings related to script execution in chart contexts
• User reports of suspicious behavior on pages containing interactive charts

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor web application logs for suspicious payloads in chart configuration parameters
• Use browser developer tools or security scanners to identify XSS vectors in Highcharts implementations
• Conduct regular code reviews of chart configuration handling logic for proper input sanitization

Monitoring Recommendations

• Enable CSP violation reporting to capture attempted XSS exploitation
• Monitor client-side JavaScript errors that may indicate blocked exploitation attempts
• Implement web application firewall (WAF) rules to detect common XSS patterns in request parameters
• Review application logs for unusual patterns in chart data inputs

How to Mitigate CVE-2021-29489

Immediate Actions Required

• Upgrade Highcharts JS to version 9 or later, which includes the security patch
• Audit all instances where chart options are populated from user input or external sources
• Implement server-side input validation and sanitization for all chart configuration data
• Apply DOMPurify recursively to the options structure as a temporary workaround if upgrade is not immediately possible

Patch Information

The vulnerability is patched in Highcharts JS version 9. Organizations should upgrade to version 9 or the latest available release to remediate this vulnerability. For detailed patch information, refer to the GitHub Security Advisory.

NetApp users should consult the NetApp Security Advisory for guidance on affected products including Cloud Backup, OnCommand Insight, OnCommand Workflow Automation, and SnapCenter.

Workarounds

• Apply DOMPurify recursively to all Highcharts options structures before rendering charts
• Implement strict Content Security Policy headers to prevent inline script execution
• Sanitize all user-provided input before incorporating it into chart configurations
• Consider using a web application firewall with XSS protection capabilities

# Example: Installing DOMPurify for sanitization workaround
npm install dompurify

# In your application code, sanitize options before passing to Highcharts:
# const cleanOptions = DOMPurify.sanitize(JSON.stringify(userOptions));
# const chart = Highcharts.chart('container', JSON.parse(cleanOptions));