XSS Vulnerability in OWASP AntiSamy - libowasp-antisamy-java Package
Summary
CVE-2021-35043: OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). Affects libowasp-antisamy-java versions < 605b26a7f9c83535f844a8f0fa17d3d2e7761e80. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OWASP AntiSamy is a Java library designed to sanitize user input and ensure that HTML content adheres to a defined policy. It is widely used to prevent cross-site scripting (XSS) attacks by filtering out potentially harmful HTML and JavaScript. However, versions prior to 1.6.4 are susceptible to an XSS vulnerability when using the HTML output serializer, which can lead to security breaches if not addressed.
Vulnerability Detail
The vulnerability identified as CVE-2021-35043 allows for cross-site scripting (XSS) attacks through the manipulation of HTML attributes in the libowasp-antisamy-java package. This issue arises when the HTML output serializer is used, permitting attackers to inject malicious scripts via specially crafted inputs. The vulnerability was demonstrated using a 'javascript:' URL with a specific character replacement, which could lead to unauthorized script execution in the user's browser. The potential ramifications include data theft, session hijacking, and other malicious activities that exploit the trust of the user.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing input validation and sanitization measures to filter out potentially harmful inputs. Additionally, avoid using the HTML output serializer until the package is updated. You can also use alternative libraries that provide similar functionality without the vulnerability.
Conclusion
The CVE-2021-35043 vulnerability in the libowasp-antisamy-java package poses a significant risk of XSS attacks through improper handling of HTML attributes. It is crucial for users of this library to upgrade to the latest version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
CVE-2021-35043 is a vulnerability in the OWASP AntiSamy library that allows for XSS attacks through HTML attributes when using the HTML output serializer.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized script execution, data theft, and session hijacking, posing significant security risks.
Yes, you can implement input validation and sanitization measures and avoid using the HTML output serializer until the package is updated.
The CVSS score for CVE-2021-35043 is 6.1, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
