GHSA-34v3-xxqp-g5g9: Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) placename property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl.
To remediate this issue, users should upgrade to 4.0.3 or later.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS Amplify maplibre-gl-js-amplifyto a version that resolves this vulnerability.Fixed in 4.0.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using maplibre-gl-js-amplify before 4.0.3 are exposed if they render GeoJSON feature data through popupRender or render geofence IDs through AmplifyGeofenceControl. The affected values are GeoJSON title, address, and place_name properties, and the geofenceId value.
What does an attacker need to exploit it?
An attacker needs authenticated access and a way to supply malicious HTML or script in one of the affected GeoJSON properties or in a geofenceId value. Exploitation also requires a user to interact with the rendered content.
Is an upgrade available?
Yes. Upgrade maplibre-gl-js-amplify to version 4.0.3 or later.