XSS Vulnerability in jsoup: Inadequate Sanitization of javascript: URLs
Summary
CVE-2022-36033: jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. Affects jsoup versions < c5964172763e1495786ad584c368ac3346d0ca8c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsoup is a Java HTML parser designed for HTML editing, cleaning, scraping, and ensuring cross-site scripting (XSS) safety. It allows developers to manipulate and extract data from HTML documents easily. However, jsoup has a vulnerability that can lead to XSS attacks due to improper sanitization of certain URL expressions, particularly those starting with 'javascript:'. This issue arises when the non-default option 'SafeList.preserveRelativeLinks' is enabled, allowing potentially harmful URLs to be processed without adequate filtering.
Vulnerability Detail
The vulnerability (CVE-2022-36033) in jsoup stems from its failure to properly sanitize HTML that includes 'javascript:' URL expressions. When this option is enabled, crafted URLs containing control characters may bypass sanitization, leading to potential XSS attacks if the content is published on a site lacking a proper Content Security Policy (CSP). This flaw can allow attackers to execute malicious scripts in the context of a user's session, compromising user data and application integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, users can disable the 'SafeList.preserveRelativeLinks' option in jsoup. This will prevent the rewriting of input URLs as absolute URLs. Furthermore, it is crucial to implement a robust Content Security Policy (CSP) to mitigate the risk of XSS attacks. Example of disabling the option in code:
jsoup.safelist().preserveRelativeLinks(false);
Conclusion
The jsoup vulnerability CVE-2022-36033 highlights the importance of proper sanitization of user inputs, particularly in web applications. By upgrading to the latest version and implementing security best practices, developers can protect their applications from potential XSS attacks.
See every vulnerability recorded for jsoup →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
All versions of jsoup prior to 1.15.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
A Content Security Policy (CSP) is a security feature that helps prevent XSS attacks by controlling which resources can be loaded and executed in a web application.
If you cannot upgrade immediately, disable the 'SafeList.preserveRelativeLinks' option and ensure a proper Content Security Policy is in place.
Related vulnerabilities
Recent vulnerabilities recorded for jsoup.
