Cross-Site Scripting Vulnerability in libowasp-esapi-java: Improper URL Sanitization
Summary
CVE-2022-24891: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Affects libowasp-esapi-java across 2 version ranges.
< 2.4.0.0-0+deb11u1
< 7797bc3ebd3a3bd700817b27e2a4455a0ba61f33
Fixed in 2.4.0.0-0+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OWASP Enterprise Security API (ESAPI) is a free, open-source library designed to provide web application security controls. It offers a range of functionalities, including input validation, output encoding, and security configuration management. The library is widely used to enhance the security posture of Java-based applications. However, prior to version 2.3.0.0, a flaw in the antisamy-esapi.xml configuration file exposed it to a cross-site scripting (XSS) vulnerability, specifically related to the improper sanitization of 'javascript:' URLs.
Vulnerability Detail
The vulnerability arises from an incorrect regular expression for 'onsiteURL' in the antisamy-esapi.xml configuration file. This flaw allows 'javascript:' URLs to bypass sanitization, potentially leading to XSS attacks where malicious scripts can be executed in the context of the user's browser. Such attacks can compromise user data, session tokens, and overall application integrity, making it crucial to address this issue promptly.
How To Fix
Minimum fixed version
2.4.0.0-0+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libowasp-esapi-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, manually edit the antisamy-esapi.xml configuration file to modify the 'onsiteURL' regular expression. This can be done by locating the file in your project and replacing the existing regex with a more secure version that properly sanitizes 'javascript:' URLs. Here is an example of how to change the regex:
<onsiteURL>^(https?|ftp|file|mailto|tel|data):.*$</onsiteURL>
Conclusion
In summary, the cross-site scripting vulnerability in libowasp-esapi-java due to improper URL sanitization poses significant risks to web applications. It is essential to update to the latest version or apply the recommended workaround to safeguard against potential attacks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for libowasp-esapi-java →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized script execution, data theft, and session hijacking, which can severely compromise user security and application integrity.
Yes, the vulnerability is patched in version 2.3.0.0 and later of libowasp-esapi-java.
If an immediate update is not possible, implement the provided workaround by modifying the antisamy-esapi.xml configuration file to mitigate the risk until an update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-esapi-java.
