Mutation XSS Vulnerability in Python Bleach Package
Summary
CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argume... Affects python-bleach across 2 version ranges.
< 3.2.1-2.1
< 79b7a3c5e56a09d1d323a5006afa59b56162eb13
Fixed in 3.2.1-2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python Bleach is a popular library used for sanitizing HTML and preventing XSS (Cross-Site Scripting) attacks. It allows developers to safely render user-generated content by removing potentially harmful tags and attributes. However, certain configurations can expose users to vulnerabilities, particularly when specific tags are allowed in conjunction with the strip_comments option.
Vulnerability Detail
The vulnerability, identified as CVE-2021-23980, is a mutation XSS that arises when users call the bleach.clean function with specific configurations. It occurs when the following conditions are met: the allowed tags include 'p' or 'br', and the tags 'svg' or 'math' are also allowed, along with style, title, noscript, script, textarea, noframes, iframe, or xmp. Additionally, the keyword argument strip_comments must be set to False. This combination can lead to the execution of malicious scripts, posing a significant security risk to applications using the library.
How To Fix
Minimum fixed version
3.2.1-2.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bleachTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the bleach.clean function with the specified configurations. Instead, sanitize user input by using a more restrictive set of allowed tags, or set strip_comments to True to mitigate the risk of XSS attacks.
Conclusion
The mutation XSS vulnerability in the Python Bleach package poses a significant risk when specific configurations are used. It is crucial for developers to update their packages and follow best practices for sanitizing user input to protect against potential attacks.
See every vulnerability recorded for python-bleach →
FAQ
CVE-2021-23980 is a vulnerability in the Python Bleach package that allows for mutation XSS under specific configurations.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
If an immediate update is not possible, consider implementing the suggested workaround by restricting allowed tags and setting strip_comments to True.
More information about Python Bleach can be found on its official GitHub repository at https://github.com/mozilla/bleach.
Related vulnerabilities
Recent vulnerabilities recorded for python-bleach.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
