Mutation XSS Vulnerability in libowasp-antisamy-java: A Security Concern
Summary
DEBIAN-CVE-2023-43643: AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Affects libowasp-antisamy-java versions < 1.7.4-1. Fixed in 1.7.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libowasp-antisamy-java is a Java library designed for the secure cleansing of HTML content originating from untrusted sources. It provides configurable options to sanitize HTML, ensuring that potentially harmful scripts are removed before rendering. This library is widely used in applications that require user-generated content to be displayed safely. However, prior to version 1.7.4, it was found to be vulnerable to a mutation XSS (mXSS) attack due to improper parsing of HTML when the 'preserveComments' directive is enabled.
Vulnerability Detail
The vulnerability arises from the flawed parsing mechanism in AntiSamy, which can lead to a mutation XSS (mXSS) attack. When the 'preserveComments' directive is enabled in the policy file, certain HTML tags can be allowed, which may allow malicious inputs to be executed as scripts when the sanitized output is rendered. This can lead to unauthorized actions being performed on behalf of users, potentially compromising sensitive data and application integrity.
How To Fix
Minimum fixed version
1.7.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libowasp-antisamy-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the 'preserveComments' directive in your policy file to mitigate the risk of this vulnerability until you can update to the patched version. Ensure that your policy file does not allow any tags that could be exploited.
Conclusion
The mutation XSS vulnerability in libowasp-antisamy-java poses a significant risk to applications that utilize this library for HTML sanitization. It is crucial to update to version 1.7.4 or later to mitigate this risk. Additionally, employing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
Mutation XSS is a type of cross-site scripting attack where malicious scripts are injected into a web application through the manipulation of the Document Object Model (DOM).
You can check if your application is affected by using tools like Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
If exploited, this vulnerability can allow attackers to execute arbitrary scripts in the context of the user's session, potentially leading to data theft, session hijacking, or other malicious actions.
Yes, you can temporarily disable the 'preserveComments' directive in your policy file as a workaround until you can apply the necessary updates.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-43643.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
