Hi Petar,

Thanks for getting back to me.  We have been using these  controls in our application. Recently we have submitted our application to a Scan which would report us for any possible vulnerabilities. As i have mentioned those three javascript files  along with the couple of them have been identified as vulnerabilites for our application. I have included the screenshots for the same.

Also can you please help me in sending the recent versions of the javascript files for the below files. 

 ig_shared.js

ig_spellcheckerdialog.js

ig_webtree.js

ig_webcalendarview.js

ig_webdayview.js

ig_webGauge.js

ig_webmonthview.js

ig_webscheduleinfo.js

In the attachment i have included the screenshots where it has pin pointed the root for the vulnerability and also the function where the vulnerability has thrown. Please let me know the plan of action that you are going to take in this regard. Will you be working on our javascript files to fix the issue ?? .   Also pls let me know if you need any other information. 

Hello Bhargav,

Please feel free to contact me if you need any additional information regarding this matter.

Hi Petar,

Sorry was working on other things which took more priority , At our end we use a security scanning tool called fortify Audit Workbench to scan our code and this tool has reported outstanding High issues which are all pointing to the Infragistics javascript functions. We need some one to address these issues for those javascript functions to resolve those issues so that our application will become less vulnerable.

ig_webcalendarview.js

ig_WebCalendarView.prototype.callbackRender = function(response, context)

Details of  the Vulnerabilties

The file ig_webcalendarview.js interprets unvalidated user input as source code on line 503. Interpreting user-controlled instructions at run-time can allow attackers to execute malicious code.

and the exact code where we have issues are 

var json = eval(response.replace(/\^/g, "\""));

and the recommendations for this vulnerabilties are

avoid dynamic code interpretation whenever possible. If your program's functionality requires code to be interpreted dynamically, the likelihood of attack can be minimized by constraining the code your program will execute dynamically as much as possible, limiting it to an application- and context-specific subset of the base programming language.

If dynamic code execution is required, unvalidated user input should never be directly executed and interpreted by the application. Instead, a level of indirection should be introduced: create a list of legitimate operations and data objects that users are allowed to specify, and only allow users to select from the list. With this approach, input provided by users is never executed directly.

We have similar kind of issues reported for following javascript functions

ig_webdayview.js

ig_webGauge.js

ig_webmonthview.js

ig_webscheduleinfo.js

all of them having the same vulnerability for the below code

var json = eval(response.replace(/\^/g, "\""));

Following were the OWASP standards reference being reported for these vulnerabilities

[1] A1 Injection, Standards Mapping - OWASP Top 10 2010 - (OWASP 2010)

[2] A1 Injection, Standards Mapping - OWASP Top 10 2013 - (OWASP 2013)

[3] A2 Injection Flaws, Standards Mapping - OWASP Top 10 2007 - (OWASP 2007)

[4] A3 Malicious File Execution, Standards Mapping - OWASP Top 10 2007 - (OWASP 2007)

[5] A6 Injection Flaws, Standards Mapping - OWASP Top 10 2004 - (OWASP 2004)

From your earlier where in you have asked for a working copy of the code, we could not provide that because ours is a financial firm and it becomes part of security violation if we share our code outside the firm. Thats the reason i have mentioned the vulnerabilities in here. So we need immediate attention for these issues so that we can close out these vulnerabilities ASAP.