Mutation XSS Vulnerability in Mozilla Bleach Package
Summary
CVE-2020-6816: In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False. Affects python-bleach across 2 version ranges.
< 3.1.3-1
< 78a06726dd6c72a42c90c1f7a8fa5d21ebcfa587
Fixed in 3.1.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mozilla Bleach is a popular Python library used for sanitizing HTML and preventing cross-site scripting (XSS) attacks. It is widely utilized in web applications to ensure that user-generated content is safe for display. The library allows developers to whitelist certain HTML tags and attributes, providing flexibility in content rendering while maintaining security. However, a vulnerability was discovered in versions prior to 3.12, where improper handling of RCDATA and specific SVG or math tags could lead to a mutation XSS attack.
Vulnerability Detail
The vulnerability, identified as CVE-2020-6816, arises from the bleach.clean function when RCDATA and either SVG or math tags are whitelisted with the strip argument set to False. This flaw allows an attacker to inject malicious scripts into the sanitized output, potentially compromising the security of web applications that rely on Bleach for content sanitization. The issue is particularly concerning as it can lead to unauthorized script execution in the user's browser, resulting in data theft or session hijacking.
How To Fix
Minimum fixed version
3.1.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bleachTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can avoid using the RCDATA, SVG, or math tags in their whitelists until they can upgrade to a secure version. Additionally, setting the strip argument to True can help mitigate the risk by removing potentially harmful tags from user input.
Conclusion
The CVE-2020-6816 vulnerability in the Mozilla Bleach package poses a significant risk for web applications that utilize this library for HTML sanitization. It is crucial for developers to upgrade to the latest version to protect against potential XSS attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring the security of your applications.
See every vulnerability recorded for python-bleach →
FAQ
CVE-2020-6816 is a vulnerability in the Mozilla Bleach library that allows for mutation XSS attacks when certain tags are whitelisted.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the context of the user's browser, leading to data theft or session hijacking.
Versions of Bleach prior to 3.1.3-1 are affected by this vulnerability.
Yes, you can temporarily avoid using RCDATA, SVG, or math tags in your whitelists and set the strip argument to True to remove harmful tags.
Related vulnerabilities
Recent vulnerabilities recorded for python-bleach.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
