PT-2023-26481 · Typo3 · Typo3/Html-Sanitizer

David Klein + 1 · Published 2023-07-25 · Updated 2023-08-02 · CVE-2023-38500

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 HTML Sanitizer versions 1.0.0 through 1.5.1 TYPO3 HTML Sanitizer versions 1.0.0 through 2.1.2

Description The issue arises from an encoding problem in the serialization layer of TYPO3 HTML Sanitizer, allowing malicious markup nested in a noscript element to bypass the cross-site scripting mechanism. The noscript element is disabled by default but may be enabled in custom configurations. This enables the bypassing of the cross-site scripting protection provided by TYPO3 HTML Sanitizer.

Recommendations Update to version 1.5.1 or 2.1.2 to fix the issue. As a temporary workaround, consider disabling the noscript element in custom configurations until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-38500

GHSA-59JF-3Q9V-RH6G

Affected Products

Typo3/Html-Sanitizer

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38500.json · Exploit
• https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g · Vendor Advisory
• https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-38500 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38500 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2023-002 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59jf-3q9v-rh6g · Vendor Advisory
• https://github.com/TYPO3/html-sanitizer · Note
• https://t.me/cibsecurity/67264 · Telegram Post