Security for Excel Exports

[Donald]

Hello,

It is not clear from your documentation whether you are still relying on jszip.js for Excel exports.  We have found that this library has critical security vulnerabilities that have not been addressed by the FOSS developer who created it.

Please advise as to what you recommend.

 

Thanks.

[Mihaela]

Hello Donald,

The JSZip library is required for the Excel exports, as stated in the Export Support section in the documentation.

Would you please let us know if the security vulnerabilities you mentioned are found in the latest version? Generally, the Kendo UI for jQuery/MVC/Core(Exporting) is compatible with JSZip 3.x starting v2023.3.1114 (R3 2023 SP1). You can upgrade to the latest JSZip version (3.10.1).

Regards,
Mihaela
Progress Telerik

[Donald]

This is the version of Jszip that is insecure.  The random-number generator used by Jszip is vulnerable to cyberattacks and the creator of the library has not maintained it.

[Mihaela]

Hello Donald,

I have found the following two issues in the JSZip repo:

• Fortify scan finds Insecure Randomness vulnerability in jszip.js, line 11488
• Math.random() usage

According to the source code, Math.random() is used to create a prefix for a variable name rather than for data encryption:

https://github.com/Stuk/jszip/blob/main/dist/jszip.js#L11491-L11509

Also, it does not exists as a CVE report. We can state that the report is false positive since Math.random() does not cause real threats in the code.

If any additional questions arise, please let us know.

Best,

Mihaela