Mutation XSS Vulnerability in libowasp-antisamy-java: Flawed HTML Parsing
Summary
DEBIAN-CVE-2024-23635: AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Affects libowasp-antisamy-java versions 1.5.3+dfsg-1.1 – 1.7.4-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libowasp-antisamy-java is a library designed for the fast and configurable cleansing of HTML content originating from untrusted sources. It is widely used to sanitize user-generated content to prevent security issues such as XSS (Cross-Site Scripting). The library allows users to define policies for sanitization, making it flexible and adaptable to various use cases. However, prior to version 1.7.5, it contained a vulnerability that could lead to mutation XSS attacks when specific configurations were enabled.
Vulnerability Detail
The vulnerability arises from a flaw in the HTML parsing mechanism of AntiSamy when the 'preserveComments' directive is enabled in the policy file. This flaw allows certain crafted inputs to be processed in a way that elements within comment tags can be executed, leading to potential XSS attacks. The vulnerability is identified as CVE-2024-23635 and affects versions prior to 1.7.5. If exploited, it could allow attackers to execute malicious scripts in the context of the user's browser, compromising user data and application integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, consider disabling the 'preserveComments' directive in your policy file to mitigate the risk of exploitation. This can be done by modifying your AntiSamy policy configuration to set 'preserveComments' to false.
Conclusion
The libowasp-antisamy-java library is a vital tool for sanitizing HTML content, but it is crucial to be aware of the mutation XSS vulnerability (CVE-2024-23635) present in versions prior to 1.7.5. Updating to the latest version and modifying policy configurations are essential steps to ensure the security of applications using this library.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
Mutation XSS is a type of cross-site scripting vulnerability that occurs when an attacker is able to inject malicious scripts into a web application, which are then executed in the context of a user's browser.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. It allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The risks include unauthorized access to user data, session hijacking, and the potential for attackers to perform actions on behalf of users, leading to data breaches and loss of trust.
Yes, there are alternative libraries and methods for sanitizing HTML, such as DOMPurify or using built-in browser APIs, but they may have different features and levels of security.
If an immediate update is not possible, ensure that the 'preserveComments' directive is disabled in your policy file to reduce the risk of exploitation until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
