CVE-2021-29489: Highcharts JS XSS Vulnerability

CVE-2021-29489 Overview

CVE-2021-29489 is a Cross-Site Scripting (XSS) vulnerability in Highcharts JS, a popular JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors, allowing content from untrusted sources to execute arbitrary code in end users' browsers.

Critical Impact
Attackers can inject malicious scripts through unsanitized chart options, potentially stealing user credentials, session tokens, or performing actions on behalf of authenticated users.

Affected Products

Highcharts JS (versions 8 and earlier)
NetApp Cloud Backup
NetApp OnCommand Insight
NetApp OnCommand Workflow Automation
NetApp SnapCenter

Discovery Timeline

2021-05-05 - CVE-2021-29489 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-29489

Vulnerability Analysis

This vulnerability exists because the Highcharts JS library did not implement systematic filtering of XSS vectors within its chart options structure. When applications allow users or untrusted sources to supply chart configuration options, malicious JavaScript code can be injected and subsequently executed in the context of the victim's browser session.

The attack requires user interaction (such as viewing a page containing a malicious chart) and low privileges to exploit. Once executed, the injected script can access cookies, session tokens, and other sensitive information stored in the browser, or perform unauthorized actions on behalf of the user.

Root Cause

The root cause of CVE-2021-29489 is insufficient input sanitization in the Highcharts options parsing mechanism. The library accepted and processed chart configuration objects without adequately validating or sanitizing string values that could contain executable JavaScript code. This includes options that accept HTML content, SVG attributes, or callback functions where malicious payloads could be embedded.

Attack Vector

The attack vector is network-based, requiring an attacker to inject malicious content into chart options that are then rendered by the Highcharts library. Exploitation scenarios include:

The attacker can craft malicious chart configuration data containing JavaScript payloads within string properties such as labels, tooltips, or titles. When the target application renders a chart using these tainted options, the malicious script executes in the victim's browser context.

Due to the changed scope characteristic of this vulnerability, a successful attack can impact resources beyond the vulnerable component itself, potentially affecting the broader web application security context.

Detection Methods for CVE-2021-29489

Indicators of Compromise

Unexpected JavaScript execution when rendering Highcharts visualizations
Unusual network requests originating from pages containing Highcharts components
Client-side errors or console warnings related to script execution in chart contexts
User reports of suspicious behavior on pages containing interactive charts

Detection Strategies

Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
Monitor web application logs for suspicious payloads in chart configuration parameters
Use browser developer tools or security scanners to identify XSS vectors in Highcharts implementations
Conduct regular code reviews of chart configuration handling logic for proper input sanitization

Monitoring Recommendations

Enable CSP violation reporting to capture attempted XSS exploitation
Monitor client-side JavaScript errors that may indicate blocked exploitation attempts
Implement web application firewall (WAF) rules to detect common XSS patterns in request parameters
Review application logs for unusual patterns in chart data inputs

How to Mitigate CVE-2021-29489

Immediate Actions Required

Upgrade Highcharts JS to version 9 or later, which includes the security patch
Audit all instances where chart options are populated from user input or external sources
Implement server-side input validation and sanitization for all chart configuration data
Apply DOMPurify recursively to the options structure as a temporary workaround if upgrade is not immediately possible

Patch Information

The vulnerability is patched in Highcharts JS version 9. Organizations should upgrade to version 9 or the latest available release to remediate this vulnerability. For detailed patch information, refer to the GitHub Security Advisory.

NetApp users should consult the NetApp Security Advisory for guidance on affected products including Cloud Backup, OnCommand Insight, OnCommand Workflow Automation, and SnapCenter.

Workarounds

Apply DOMPurify recursively to all Highcharts options structures before rendering charts
Implement strict Content Security Policy headers to prevent inline script execution
Sanitize all user-provided input before incorporating it into chart configurations
Consider using a web application firewall with XSS protection capabilities

bash

# Example: Installing DOMPurify for sanitization workaround
npm install dompurify

# In your application code, sanitize options before passing to Highcharts:
# const cleanOptions = DOMPurify.sanitize(JSON.stringify(userOptions));
# const chart = Highcharts.chart('container', JSON.parse(cleanOptions));