Mutation XSS Vulnerability in libowasp-antisamy-java: Potential Risk in HTML Sanitization
Summary
UBUNTU-CVE-2024-23635: AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Affects libowasp-antisamy-java versions 1.5.3+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libowasp-antisamy-java is a library designed for the fast and configurable cleansing of HTML content originating from untrusted sources. It is widely used to sanitize user inputs in web applications, ensuring that potentially harmful scripts are removed before rendering. However, prior to version 1.7.5, the library had a vulnerability that could lead to mutation cross-site scripting (mXSS) attacks when specific configurations were enabled.
Vulnerability Detail
The vulnerability arises from flawed parsing of HTML when the 'preserveComments' directive is enabled in the policy file. This flaw allows malicious inputs to be processed in such a way that elements within comment tags can be executed, leading to potential security breaches. The issue is particularly concerning as it can be exploited without user interaction, making it a significant risk for applications relying on this library for sanitization.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the 'preserveComments' directive in your policy file to mitigate the risk of exploitation. This can be done by modifying the policy file as follows:
<policy> ``` <preserveComments>false</preserveComments> ``` </policy>Conclusion
The libowasp-antisamy-java library has a significant vulnerability that can lead to mutation XSS attacks if not addressed. Updating to the patched version 1.7.5 or later is crucial for maintaining application security. Users are encouraged to review their configurations and consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
Mutation XSS (mXSS) is a type of cross-site scripting attack where malicious scripts are executed due to flaws in the way HTML is sanitized, particularly when comments are preserved.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized script execution, data theft, and compromise of user sessions, posing significant risks to application security.
Yes, the vulnerability has been patched in version 1.7.5 of libowasp-antisamy-java. It is recommended to update to this version or later.
If an immediate update is not possible, disable the 'preserveComments' directive in your policy file as a temporary workaround to reduce the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
