CVE-2024-6485

Executive Summary

CVE-2024-6485 is a Cross-Site Scripting (XSS) vulnerability in the Bootstrap framework, specifically within the button plugin's data-loading-text attribute. An attacker can inject malicious JavaScript code into this attribute, which executes when the button enters a loading state. The vulnerability has a CVSS score of 6.4 (Medium), with a low EPSS score (0.0%) indicating low exploitation likelihood in the wild. No official patch or exploit code is currently available. This issue affects all versions of Bootstrap that support the data-loading-text attribute.

Supply Chain & Package Security

Bootstrap is a widely used front-end framework distributed via npm, CDNs, and direct downloads. This vulnerability impacts the supply chain as applications using Bootstrap’s button plugin with user-controlled data-loading-text attributes are at risk. Organizations should audit their use of Bootstrap and ensure no user input is passed to this attribute without sanitization.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must trigger button loading state)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction and is not currently observed in the wild, but the widespread use of Bootstrap increases potential impact.

Deep Dive & Mechanics

The vulnerability resides in Bootstrap’s button plugin, which uses the data-loading-text attribute to display custom text when a button is in a loading state. The plugin sets the button’s inner HTML using this attribute without proper sanitization. An attacker can inject arbitrary HTML/JavaScript into the attribute, which is then rendered in the victim’s browser when the button’s loading state is triggered (e.g., via a click event).

Root Cause: The plugin uses $(this).data('loading-text') and directly assigns it to .html() or similar DOM manipulation methods without escaping or sanitizing the input.

Attack Scenario:

1. An attacker crafts a malicious link or form with a button containing data-loading-text="<img src=x onerror=alert('XSS')>".
2. The victim clicks the button, triggering the loading state.
3. The injected script executes in the victim’s browser context.

Vulnerable vs. Patched Code

Vulnerable Code (Bootstrap Button Plugin):

// Vulnerable: directly sets innerHTML from data attribute
var loadingText = $(this).data('loading-text');
$(this).html(loadingText);

Patched Code (Hypothetical Fix):

// Patched: sanitize or use text() instead of html()
var loadingText = $(this).data('loading-text');
$(this).text(loadingText); // or use DOMPurify

Note: No official patch is available. The fix should involve using .text() instead of .html() or sanitizing the input with a library like DOMPurify.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A web application using Bootstrap’s button plugin with user-controlled data-loading-text.
• Victim must click the button.

Exploit Payload:

<button type="button" class="btn btn-primary" data-loading-text="<img src=x onerror=alert('XSS')>">Click me</button>

Steps:

1. Host a page with the malicious button.
2. Lure the victim to click the button.
3. The injected script executes.

Note: No public exploit code is available from Exploit-DB.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual data-loading-text attributes in HTTP requests.
• Use Content Security Policy (CSP) to block inline scripts.

Prevention:

• Sanitize all user input before using in data-loading-text.
• Upgrade Bootstrap to a patched version when available.
• Implement CSP headers: script-src 'self';.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing data-loading-text with suspicious HTML/JavaScript.
• File: Modified Bootstrap button plugin files with unsanitized data-loading-text.
• Behavior: Unexpected script execution when buttons are clicked.

Example IOC (Log Entry):

GET /page?button_text=<img src=x onerror=alert(1)> HTTP/1.1

Detection Engineering

YARA Rule

rule CVE_2024_6485_Bootstrap_XSS {
    meta:
        description = "Detects Bootstrap button plugin with unsanitized data-loading-text"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6485"
    strings:
        $vuln_pattern = /data-loading-text\s*=\s*["'][^"']*<[^>]*onerror[^>]*>/
    condition:
        $vuln_pattern
}

Sigma Rule

title: CVE-2024-6485 Bootstrap XSS via data-loading-text
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with malicious data-loading-text attribute
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'data-loading-text'
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
    condition: selection and keywords
falsepositives:
    - Legitimate use of data-loading-text with safe content
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6485 Bootstrap XSS via data-loading-text"; flow:to_server,established; content:"data-loading-text"; http_uri; pcre:"/data-loading-text\s*=\s*["'][^"']*<[^>]*onerror[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Sanitize all user input used in data-loading-text attributes. Use .text() instead of .html() in the button plugin.
2. Short-term: Implement Content Security Policy (CSP) headers to block inline scripts.
3. Long-term: Monitor Bootstrap releases for an official patch and upgrade when available.
4. Workaround: Disable the button plugin or use a custom implementation that sanitizes input.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI Assistant.