CVE-2010-4183: HTML Purifier cross-site scripting (XSS) vulnerability in ezyang/htmlpurifier
Summary
CVE-2010-4183: HTML Purifier cross-site scripting (XSS) vulnerability. Affects ezyang/htmlpurifier versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Also tracked for
- php-htmlpurifier · Debian:11
The same CVE-2010-4183 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HTML Purifier is a library that sanitizes HTML code to prevent cross-site scripting (XSS) attacks. It is commonly used in web applications to ensure that user-generated content does not contain malicious code. The vulnerability affects versions prior to 4.1.0 of the library when used with Internet Explorer. This vulnerability allows remote attackers to inject arbitrary web script or HTML through crafted CSS properties such as background-image, background, or font-family.
Vulnerability Detail
The HTML Purifier library, when used with Internet Explorer, is susceptible to multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities enable attackers to inject arbitrary web script or HTML into web pages. The specific CSS properties mentioned in the vulnerability details (background-image, background, and font-family) can be manipulated to execute malicious code on the client-side. This can lead to various security risks, including session hijacking, data theft, and defacement of web pages.
How To Fix
Minimum fixed version
4.1.0
This is the first release that contains the fix.
composer require ezyang/htmlpurifier:4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement additional input validation and output encoding measures in the affected application. This can help mitigate the risk of XSS attacks. However, it is important to note that workarounds may not provide complete protection and should be considered temporary solutions until the library can be updated.
Conclusion
The HTML Purifier library prior to version 4.1.0 is vulnerable to cross-site scripting (XSS) attacks when used with Internet Explorer. It is crucial to update to the latest secure version of the library to mitigate the risk of exploitation. If immediate upgrading is not possible, implementing temporary workarounds can provide some level of protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ezyang/htmlpurifier →
FAQ
HTML Purifier is a library used to sanitize HTML code and prevent cross-site scripting (XSS) attacks.
Versions prior to 4.1.0 of the HTML Purifier library are affected when used with Internet Explorer.
Attackers can exploit this vulnerability by injecting malicious web script or HTML through crafted CSS properties in web pages.
The consequences of this vulnerability include session hijacking, data theft, and defacement of web pages.
A temporary workaround is to implement additional input validation and output encoding measures in the affected application.
Related vulnerabilities
Recent vulnerabilities recorded for ezyang/htmlpurifier.
