CVE-2024-6484

What it actually does

Unsanitized data-slide and data-slide-to attributes on anchor tags within the carousel component allow injection and execution of arbitrary JavaScript in the victim's browser context.

Why it matters to the business

Websites using the affected Bootstrap version can be abused to run malicious code in visitors' browsers, risking stolen credentials, session hijacking, or site defacement that erodes user trust and may trigger regulatory scrutiny.

How an attack unfolds

An attacker crafts a malicious anchor element containing executable JavaScript inside the data-slide or data-slide-to attribute, places it inside a Bootstrap carousel on a page the victim visits, and triggers execution when the carousel processes the attribute without sanitization.

How to fix it

Upgrade twitter-bootstrap3 to the fixed package versions: 3.4.1+dfsg-4 on Debian 13, 3.4.1+dfsg-2+deb11u1 on Debian 11, or 3.4.1+dfsg-3+deb12u1 on Debian 12. Replace all instances of the carousel markup and bootstrap.js files with the patched release.

How to confirm the fix worked

Verify the installed package version matches one of the fixed releases, inspect rendered carousel HTML to confirm data attributes are properly escaped, and run automated markup scanners against sample pages containing carousels.

Typical attack path

1. Locate a web page using the vulnerable Bootstrap carousel component
2. Inject an anchor tag with a crafted href or data attribute containing a JavaScript payload
3. Lure a victim to interact with the carousel (click or slide)
4. Execute arbitrary JavaScript in the victim's browser session

How to detect it

Review web server access logs and application logs for requests containing suspicious data-slide or data-slide-to values; inspect rendered page source for unexpected script execution in carousel markup; monitor browser console or security event logs for unauthorized JavaScript activity on pages using carousels.

What your security team should do

• Immediately update all instances of twitter-bootstrap3 to the listed fixed Debian package versions
• Audit all web applications for remaining copies of the vulnerable carousel component
• Implement content-security-policy headers to restrict inline script execution as a defense-in-depth measure
• Add Bootstrap version checks to continuous integration pipelines to prevent regression