Mutation XSS Vulnerability in org.owasp.antisamy:antisamy
Summary
CVE-2024-23635: Malicious input can provoke XSS when preserving comments. Affects org.owasp.antisamy:antisamy versions < 1.7.5. Fixed in 1.7.5. How to fix ↓
Also tracked for
- libowasp-antisamy-java · Debian:11
The same CVE-2024-23635 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.owasp.antisamy:antisamy package is an open-source library that provides protection against cross-site scripting (XSS) attacks by sanitizing HTML input. It is commonly used in web applications to prevent malicious code execution. However, a vulnerability has been discovered in versions prior to 1.7.5 that allows for mutation XSS (mXSS) attacks when the 'preserveComments' directive is enabled in the policy file.
Vulnerability Detail
The vulnerability arises from flawed parsing of HTML during the sanitization process. When the 'preserveComments' directive is enabled, certain inputs can result in comment tags being interpreted as executable code. This can lead to the execution of malicious scripts and potential compromise of user data. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.7.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, a temporary workaround is to manually edit the AntiSamy policy file (e.g., antisamy.xml) by either deleting the 'preserveComments' directive or setting its value to 'false'. This workaround disables the preconditions for the mXSS attack to work. However, it does not address the root cause of the vulnerability and relies on configurations that may change in the future. Therefore, upgrading to a fixed version is strongly recommended.
Conclusion
The mutation XSS vulnerability in org.owasp.antisamy:antisamy can be mitigated by upgrading to version 1.7.5 or later. A temporary workaround is available by modifying the policy file, but it is recommended to upgrade to address the root cause. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.owasp.antisamy:antisamy →
FAQ
org.owasp.antisamy:antisamy is an open-source library used for sanitizing HTML input to prevent cross-site scripting (XSS) attacks in web applications.
Mutation XSS (mXSS) is a type of cross-site scripting attack where the attacker manipulates the input in a way that the sanitized output contains executable code.
The vulnerability occurs due to flawed parsing of HTML during the sanitization process. When the 'preserveComments' directive is enabled, certain inputs can be interpreted as executable code.
The vulnerability can lead to the execution of malicious scripts and potential compromise of user data in applications using org.owasp.antisamy:antisamy with the 'preserveComments' directive enabled.
The vulnerability can be fixed by updating to version 1.7.5 or later of org.owasp.antisamy:antisamy. This update includes a patch that resolves the parsing behavior issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.owasp.antisamy:antisamy.
