Mutation XSS Vulnerability in Python Bleach Package
Summary
CVE-2020-6802: In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option. Affects python-bleach across 2 version ranges.
< 0d88dd83e425c4ba381d5b83fe61bfae5bbbd627
< 3.1.1-1
Fixed in 3.1.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Bleach is a popular library used for sanitizing HTML and preventing XSS attacks. It allows developers to clean up and filter user-generated content, ensuring that only safe HTML is rendered. Despite its robust functionality, a vulnerability was discovered in versions prior to 3.11, which could lead to mutation-based cross-site scripting (XSS) attacks when using specific configurations.
Vulnerability Detail
The vulnerability, identified as CVE-2020-6802, arises when users call the bleach.clean function with the 'noscript' tag and a raw tag included in the allowed tags option. This configuration can lead to a mutation XSS, where an attacker can inject malicious scripts that execute when the content is rendered in a browser. The potential ramifications include unauthorized access to user data, session hijacking, and other security breaches. The vulnerability affects multiple Debian ecosystems, including versions 11, 12, and 13, and has a CVSS score of 6.1, indicating a medium severity level.
How To Fix
Minimum fixed version
3.1.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bleachTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to avoid using the 'noscript' tag in the allowed tags option when calling the bleach.clean function. This reduces the risk of mutation XSS attacks until the package can be updated.
Conclusion
The mutation XSS vulnerability in the Python Bleach package poses a significant risk to applications that utilize this library for sanitizing HTML content. Users are strongly advised to upgrade to the latest version to mitigate potential security threats. Additionally, understanding the nature of this vulnerability can help developers implement safer coding practices.
See every vulnerability recorded for python-bleach →
FAQ
CVE-2020-6802 is a vulnerability in the Python Bleach library that allows for mutation-based XSS attacks when specific configurations are used.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences can include unauthorized access to user data, session hijacking, and the potential for attackers to execute malicious scripts in the context of the user’s session.
Yes, you can mitigate the risk by avoiding the use of the 'noscript' tag in the allowed tags option when using the bleach.clean function.
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-bleach.
