PT-2022-16031 · Typo3 · Typo3/Html-Sanitizer

David Klein · Published 2022-12-13 · Updated 2022-12-16 · CVE-2022-23499

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions typo3/html-sanitizer versions prior to 1.5.0 or 2.1.1

Description The HTML sanitizer is written in PHP and aims to provide XSS-safe markup based on explicitly allowed tags, attributes, and values. However, due to a parsing issue in the upstream package masterminds/html5, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (script, style, noframes, noembed, and iframe) as DOMText nodes, which were not processed and sanitized further. Only custom behaviors using one of those tag names were vulnerable to cross-site scripting.

Recommendations Update to version 1.5.0 or 2.1.1 to fix the issue. As a temporary workaround, consider disabling custom behaviors that use the script, style, noframes, noembed, or iframe tag names until a patch is available. Restrict access to the vulnerable masterminds/html5 package to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23499

GHSA-HVWX-QH2H-XCFJ

Affected Products

Typo3/Html-Sanitizer

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23499.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23499.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2022-23499 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hvwx-qh2h-xcfj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23499 · Security Note
• https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-hvwx-qh2h-xcfj · Note
• https://github.com/TYPO3/html-sanitizer/pull/106 · Note
• https://github.com/TYPO3/html-sanitizer · Note
• https://github.com/TYPO3/html-sanitizer/releases/tag/v2.1.1 · Note
• https://github.com/TYPO3/html-sanitizer/pull/105 · Note
• https://github.com/TYPO3/html-sanitizer/releases/tag/v1.5.0 · Note
• https://t.me/cibsecurity/54469 · Telegram Post
• https://t.me/cvenotify/39782 · Telegram Post
• https://typo3.org/security/advisory/typo3-core-sa-2022-017 · Note