CVE-2021-29489
📋 TL;DR
CVE-2021-29489 is a cross-site scripting (XSS) vulnerability in Highcharts JS versions 8 and earlier. It allows attackers to inject malicious scripts through untrusted chart options, potentially executing arbitrary code in users' browsers. Websites using vulnerable Highcharts versions are affected.
💻 Affected Systems
- Highcharts JS
📦 What is this software?
Highcharts by Highcharts
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of user sessions, credential theft, defacement, or malware delivery to all visitors of affected websites.
Likely Case
Session hijacking, credential theft, or malicious redirects for users visiting compromised pages.
If Mitigated
No impact if proper input sanitization or patched versions are used.
🎯 Exploit Status
XSS vulnerabilities are commonly exploited; advisory includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.0
Vendor Advisory: https://github.com/highcharts/highcharts/security/advisories/GHSA-8j65-4pcq-xq95
Restart Required: No
Instructions:
1. Update Highcharts JS to version 9.0.0 or later. 2. Replace the library files in your project. 3. Test chart functionality.
🔧 Temporary Workarounds
Apply DOMPurify Recursively
allSanitize chart options structure using DOMPurify before passing to Highcharts.
npm install dompurify
import DOMPurify from 'dompurify';
const sanitizedOptions = DOMPurify.sanitize(options, {RETURN_DOM_FRAGMENT: false});
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all chart options data.
- Use Content Security Policy (CSP) headers to restrict script execution.
🔍 How to Verify
Check if Vulnerable:
Check Highcharts version in your project's package.json or script tags; versions ≤8.x are vulnerable.Check Version:
grep -r 'highcharts' package.json || check script src attributes in HTML.Verify Fix Applied:
Confirm Highcharts version is ≥9.0.0 and test with malicious input in chart options.📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript errors in browser logs related to chart rendering.
Network Indicators:
- Suspicious payloads in POST/GET requests to chart data endpoints.
SIEM Query:
source="web_logs" AND (uri="*chart*" OR uri="*highcharts*") AND (payload="*script*" OR payload="*onerror*")