XSS Vulnerability in OWASP AntiSamy - libowasp-antisamy-java Package
Summary
CVE-2022-28367: OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. Affects libowasp-antisamy-java across 2 version ranges.
< 99b1143bd2219c7645a8d68ca856a51e67f7bbfa
< 0199e7e194dba5e7d7197703f43ebe22401e61ae
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OWASP AntiSamy is a Java library designed to sanitize user input and prevent XSS (Cross-Site Scripting) attacks by enforcing a strict set of rules on HTML and CSS content. The libowasp-antisamy-java package is widely used in web applications to ensure that user-generated content is safe for display. However, prior to version 1.6.6, it was found to be vulnerable to a specific XSS attack through HTML tag smuggling in STYLE content, which could allow attackers to inject malicious scripts.
Vulnerability Detail
The vulnerability, identified as CVE-2022-28367, arises from the output serializer of the OWASP AntiSamy library not properly encoding CSS content. This flaw allows attackers to exploit the library by crafting specific input that can bypass sanitization, leading to potential XSS attacks. The ramifications of this vulnerability include unauthorized access to user sessions, data theft, and the ability to manipulate web application behavior. The vulnerability affects multiple versions of the libowasp-antisamy-java package across different Debian ecosystems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation and sanitization on your own before passing user input to the AntiSamy library. This can help mitigate the risk of XSS attacks until the library is updated. Additionally, you can restrict the use of certain HTML tags and attributes that are known to be problematic.
Conclusion
The CVE-2022-28367 vulnerability in the OWASP AntiSamy library poses a significant risk to applications using the libowasp-antisamy-java package. It is crucial to update to the latest version to mitigate potential XSS attacks. Additionally, implementing input validation can serve as a temporary workaround until the library is updated.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
CVE-2022-28367 is a vulnerability in the OWASP AntiSamy library that allows XSS attacks through improperly encoded CSS content.
Versions prior to 1.6.6 in Debian 11 and 12, and all versions in Debian 13 before 1.7.4-1 are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized access to user sessions, data theft, and manipulation of web application behavior due to XSS attacks.
The CVSS score for CVE-2022-28367 is 6.1, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
