CVE-2024-6485 Overview
CVE-2024-6485 is a Cross-Site Scripting (XSS) vulnerability affecting the Bootstrap front-end framework. The flaw resides in the button plugin's handling of the data-loading-text attribute. An attacker who can influence the contents of this attribute can inject JavaScript that executes in the victim's browser when the button transitions to its loading state. The vulnerability is categorized as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the victim's browser session, enabling session theft, credential harvesting, or unauthorized actions on behalf of the user.
Affected Products
- Bootstrap (button plugin component)
- Debian LTS distributions bundling vulnerable Bootstrap versions
- Web applications embedding the affected Bootstrap button plugin
Discovery Timeline
- 2024-07-11 - CVE-2024-6485 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-6485
Vulnerability Analysis
The vulnerability stems from improper neutralization of user-controllable input rendered through the Bootstrap button plugin. The data-loading-text attribute is used by the plugin to display text on a button while an associated action is in progress. When the plugin updates the button's content with the value of this attribute, the content is rendered without sufficient sanitization. An attacker who controls or injects this attribute value can embed JavaScript that executes when the button enters the loading state.
Exploitation requires user interaction to trigger the button's loading state, which contributes to the elevated attack complexity. The flaw is network-reachable because affected pages are typically served over HTTP. Once triggered, attacker-controlled script runs with the privileges of the hosting page, exposing cookies, tokens, and DOM content.
Root Cause
The root cause is missing output encoding when the button plugin assigns the data-loading-text value into the button's inner HTML. Because the attribute value is treated as markup rather than text, any embedded <script> tags or event handler attributes are parsed and executed by the browser.
Attack Vector
An attacker injects malicious JavaScript into the data-loading-text attribute, typically through a stored or reflected injection point in the host application. When a legitimate user interacts with the button and triggers its loading state, the Bootstrap plugin renders the attacker-supplied markup, executing the payload in the user's browser session. See the HeroDevs CVE-2024-6485 Details for technical details.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in vendor and distribution advisories rather than reproduced here.
Detection Methods for CVE-2024-6485
Indicators of Compromise
- HTML responses containing data-loading-text attributes with embedded <script> tags, javascript: URIs, or inline event handlers such as onerror= and onload=.
- Unexpected outbound requests from user browsers to attacker-controlled domains following interaction with Bootstrap-based UI components.
- Web application logs showing user-supplied input being persisted into fields rendered as data-loading-text attribute values.
Detection Strategies
- Perform static analysis of application templates and components for unsanitized insertion of user input into data-loading-text attributes.
- Scan dependency manifests (package.json, composer.json, OS package databases) for vulnerable Bootstrap versions.
- Deploy Content Security Policy (CSP) violation reporting to surface unexpected inline script execution in production.
Monitoring Recommendations
- Monitor web server access logs for request parameters containing HTML or script payloads targeting form fields rendered through Bootstrap buttons.
- Alert on CSP script-src violations originating from pages that include the Bootstrap button plugin.
- Track third-party JavaScript library versions through software composition analysis (SCA) tooling and flag outdated Bootstrap installations.
How to Mitigate CVE-2024-6485
Immediate Actions Required
- Inventory all applications using Bootstrap and identify components that render data-loading-text attributes from user-controlled data.
- Upgrade Bootstrap to a patched version as documented in the Debian LTS Security Announcement.
- Apply server-side output encoding to any user input that may flow into HTML attributes, particularly Bootstrap data attributes.
- Enforce a strict Content Security Policy that blocks inline scripts to limit XSS impact.
Patch Information
Debian LTS has released updated Bootstrap packages addressing CVE-2024-6485. Refer to the Debian LTS Security Announcement and the HeroDevs CVE-2024-6485 Details for version-specific guidance. Application owners should rebuild and redeploy bundled assets after upgrading the dependency.
Workarounds
- Remove or hardcode the data-loading-text attribute on all Bootstrap buttons rather than populating it from dynamic input.
- Sanitize all user-supplied content using a vetted HTML sanitization library before it reaches templates that render Bootstrap data attributes.
- Deploy a web application firewall (WAF) rule that blocks request payloads containing HTML or script tags targeting known Bootstrap attribute names.
# Example CSP header to limit XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
