Mutation XSS Vulnerability in python-bleach Package
Summary
DEBIAN-CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argume... Affects python-bleach versions < 3.2.1-2.1. Fixed in 3.2.1-2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The python-bleach package is a popular HTML sanitization library used in Python applications to prevent XSS (Cross-Site Scripting) attacks by cleaning up user-submitted content. It allows developers to specify which HTML tags and attributes are safe to use, ensuring that potentially harmful code is removed. However, certain configurations can lead to vulnerabilities, particularly when specific tags are allowed alongside certain parameters.
Vulnerability Detail
A mutation XSS vulnerability exists in the python-bleach package when users call the bleach.clean function with specific configurations. This vulnerability arises when the following conditions are met: the 'svg' or 'math' tags are included in the allowed tags, 'p' or 'br' tags are also allowed, and the keyword argument 'strip_comments' is set to False. This combination can lead to the execution of malicious scripts, posing a significant security risk to applications utilizing this library.
How To Fix
Minimum fixed version
3.2.1-2.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bleachTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid allowing 'svg' or 'math' tags in their configurations and ensure that 'strip_comments' is set to True when calling the bleach.clean function. This can be done by modifying the function call as follows: 'bleach.clean(user_input, strip_comments=True)'.
Conclusion
The mutation XSS vulnerability in the python-bleach package poses a serious risk to applications that utilize this library under specific configurations. It is crucial for developers to update to the patched version and implement recommended workarounds to mitigate potential threats.
See every vulnerability recorded for python-bleach →
FAQ
The vulnerability is a mutation XSS that can occur when specific HTML tags are allowed in conjunction with certain parameters.
Versions prior to 3.2.1-2.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that you do not allow 'svg' or 'math' tags and set 'strip_comments' to True as a temporary measure.
More details can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-23980.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-bleach.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
