XSS Vulnerability in OWASP AntiSamy - libowasp-antisamy-java
Summary
CVE-2016-10006: In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. Affects libowasp-antisamy-java versions 1.5.3+dfsg-1.1 – 1.7.4-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OWASP AntiSamy is a library designed to sanitize user input and prevent XSS (Cross-Site Scripting) attacks by allowing only safe HTML and CSS. It is widely used in web applications to ensure that user-generated content does not contain harmful scripts. However, prior to version 1.5.5, the library had a vulnerability that allowed attackers to bypass its protections through specially crafted input, potentially leading to the execution of malicious code.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10006, arises from the ability to submit specially crafted input that includes tags supporting style with active content. This flaw allows an attacker to bypass the library's protections, leading to the possibility of executing arbitrary code in the context of the user's browser. The impact of this vulnerability is significant, as it can lead to XSS attacks, compromising user data and application integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation and sanitization on your own to filter out potentially harmful content. Additionally, avoid using tags that support style with active content until the library can be updated.
Conclusion
The CVE-2016-10006 vulnerability in the OWASP AntiSamy library poses a significant risk of XSS attacks due to improper input sanitization. It is crucial to upgrade to the latest version of the library to mitigate this risk and ensure the security of web applications.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
CVE-2016-10006 is a vulnerability in the OWASP AntiSamy library that allows attackers to bypass protections and execute arbitrary code through specially crafted input.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main consequence is the potential for XSS attacks, which can lead to data theft, session hijacking, and other malicious activities.
Yes, you can implement additional input validation and avoid using tags that support active content until the library is updated.
The CVSS score for CVE-2016-10006 is 6.1, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
