XSS Vulnerability in OWASP AntiSamy - libowasp-antisamy-java Package
Summary
CVE-2017-14735: OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL. Affects libowasp-antisamy-java versions < e76f02a77afb4e43b897f13d17b5bc1260b8afde. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libowasp-antisamy-java package is a Java library that provides a way to sanitize HTML and CSS to prevent cross-site scripting (XSS) attacks. It is widely used in web applications to ensure that user-generated content is safe for display. However, prior to version 1.5.7, it was found to be vulnerable to XSS through HTML5 entities, which could allow attackers to inject malicious scripts.
Vulnerability Detail
The vulnerability, identified as CVE-2017-14735, allows for cross-site scripting (XSS) via HTML5 entities. Attackers can exploit this vulnerability by constructing a javascript: URL using HTML5 entities, such as :, which can lead to unauthorized script execution in the context of the user's browser. This poses significant risks, including data theft, session hijacking, and the potential for further attacks on the web application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation and output encoding to mitigate the risk of XSS. For example, sanitize user input by removing or encoding potentially dangerous characters before processing or displaying it in your application.
Conclusion
The CVE-2017-14735 vulnerability in the libowasp-antisamy-java package poses a significant risk of XSS attacks through HTML5 entities. It is crucial to upgrade to the latest version to mitigate this risk. Additionally, implementing input validation and output encoding can serve as effective workarounds until an upgrade is possible.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
CVE-2017-14735 is a vulnerability in the OWASP AntiSamy library that allows for cross-site scripting (XSS) through HTML5 entities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized script execution, data theft, session hijacking, and further attacks on the web application.
The CVSS score for CVE-2017-14735 is 6.1, indicating a medium severity level.
Yes, you can implement input validation and output encoding to sanitize user input and reduce the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
