Mutation XSS Vulnerability in AntiSamy Library (CVE-2024-23635)
Summary
CVE-2024-23635: AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Affects libowasp-antisamy-java versions < 12a2e31d3855430c119480655c2bbbbb79a66ecd. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AntiSamy is a widely-used library designed for the fast and configurable cleansing of HTML content originating from untrusted sources. It is particularly valuable for web applications that need to sanitize user-generated content to prevent security threats. The library allows users to define policies for sanitization, including options to preserve comments in the HTML. However, prior to version 1.7.5, a significant vulnerability existed that could lead to mutation cross-site scripting (mXSS) attacks when the 'preserveComments' directive was enabled.
Vulnerability Detail
The vulnerability arises from a flaw in the parsing mechanism of the AntiSamy library, which can lead to mXSS when the 'preserveComments' directive is active in the policy file. This flaw allows malicious actors to craft inputs that exploit the sanitization process, resulting in executable elements being interpreted from comment tags in the sanitized output. The potential ramifications include unauthorized script execution in the context of the user's browser, leading to data theft, session hijacking, or other malicious activities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to disable the 'preserveComments' directive in your AntiSamy policy file. This can be done by modifying the policy XML file to set <preserveComments>false</preserveComments>. However, this may affect the functionality of your application if comments are essential.
Conclusion
The mutation XSS vulnerability in the AntiSamy library (CVE-2024-23635) poses a significant risk to applications that utilize this library for HTML sanitization. Users are strongly advised to upgrade to version 1.7.5 or later to mitigate this risk. Additionally, reviewing and updating policy files is crucial to ensure that the 'preserveComments' directive is appropriately configured.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
CVE-2024-23635 is a vulnerability in the AntiSamy library that allows for mutation XSS attacks when the 'preserveComments' directive is enabled.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploiting this vulnerability can lead to unauthorized script execution, potentially resulting in data theft, session hijacking, or other malicious activities.
Yes, you can temporarily mitigate the risk by disabling the 'preserveComments' directive in your AntiSamy policy file.
The CVSS score of this vulnerability is 6.1, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
