PT-2021-23639 · Unknown+1 · Bluemonday+1

Published 2021-10-18 · Updated 2023-08-08 · CVE-2021-42576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bluemonday versions prior to 1.0.16 for Go bluemonday versions prior to 0.0.8 for Python (in pybluemonday)

Description The bluemonday sanitizer does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements, potentially causing XSS vulnerabilities. This issue affects user-defined policies that allow these elements. Permitting the STYLE element in policies is particularly hazardous because bluemonday does not contain a CSS sanitizer. Newer versions of bluemonday suppress STYLE and SCRIPT elements even when allowed by a policy unless the policy explicitly requests unsafe processing.

Recommendations For bluemonday versions prior to 1.0.16 for Go, update to version 1.0.16 or later to resolve the issue. For bluemonday versions prior to 0.0.8 for Python (in pybluemonday), update to version 0.0.8 or later to resolve the issue. As a temporary workaround, consider disabling the use of SELECT, STYLE, and OPTION elements in user-defined policies until a patch is available. Restrict access to the STYLE element to minimize the risk of exploitation, as it can leak contents into HTML output.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-42576

GHSA-X95H-979X-CF3J

GO-2022-0588

PYSEC-2021-849

Affected Products

Debian

Bluemonday

References · 18

• 🔥 https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-42576 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0588 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x95h-979x-cf3j · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-42576 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-42576 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-849 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-42576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42576 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42576 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-42576 · Security Note
• https://github.com/microcosm-cc/bluemonday · Note
• https://github.com/microcosm-cc/bluemonday/commit/c788a2a4d42e081ad54a31368478820bb4a42fb4 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pybluemonday/PYSEC-2021-849.yaml · Note
• https://github.com/advisories/GHSA-x95h-979x-cf3j · Note