CVE-2020-15092
📋 TL;DR
CVE-2020-15092 is a cross-site scripting (XSS) vulnerability in TimelineJS that allows attackers to execute malicious JavaScript by injecting HTML into timeline data fields. This affects users who configure timelines via Google Sheets or JSON files, particularly when write access is granted to untrusted parties. Most users automatically receive the fix, but those using pinned versions or the WordPress plugin must update manually.
💻 Affected Systems
- TimelineJS
- knight-lab-timelinejs WordPress plugin
📦 What is this software?
Timelinejs by Northwestern
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially compromising entire user accounts or systems.
Likely Case
Malicious actors inject scripts to display phishing content, deface timelines, or steal limited user data from vulnerable pages.
If Mitigated
With proper input sanitization and access controls, the risk is reduced to minimal, preventing script execution while maintaining timeline functionality.
🎯 Exploit Status
Exploitation requires write access to Google Sheets or JSON configuration files, making it dependent on compromised credentials or insider threats.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: TimelineJS 3.7.0, WordPress plugin 3.7.0.0
Vendor Advisory: https://github.com/NUKnightLab/TimelineJS3/security/advisories/GHSA-2jpm-827p-j44g
Restart Required: No
Instructions:
1. For hosted TimelineJS users: Ensure embed URLs are not pinned to older versions. 2. For self-hosted installations: Update to TimelineJS 3.7.0. 3. For WordPress plugin users: Update to knight-lab-timelinejs version 3.7.0.0 or later.
🔧 Temporary Workarounds
Restrict Write Access
allLimit write permissions for Google Sheets or JSON configuration files to trusted users only.
Input Validation
allManually sanitize HTML input in timeline data fields before publishing.
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized modifications to timeline data sources.
- Use content security policies (CSP) to mitigate potential XSS impacts.
🔍 How to Verify
Check if Vulnerable:
Check if using TimelineJS version <3.7.0 or WordPress plugin version <3.7.0.0, or if embed URLs are pinned to older versions.Check Version:
For self-hosted: Check package.json or source files for version. For WordPress: Check plugin version in admin panel.Verify Fix Applied:
Confirm TimelineJS version is 3.7.0+ or WordPress plugin is 3.7.0.0+, and test for HTML injection in timeline fields.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to Google Sheets or JSON configuration files
- Suspicious HTML/script patterns in timeline data
Network Indicators:
- Unexpected JavaScript execution from timeline domains
SIEM Query:
Search for patterns like '<script>' or 'javascript:' in timeline data sources or web server logs.