PT-2023-29225 · Unknown · Sanitize-Html

Yaniv-Git · Published 2023-10-04 · Updated 2023-10-12 · CVE-2023-44390

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HtmlSanitizer versions prior to 8.0.723 HtmlSanitizer version 8.1.722-beta and earlier

Description The issue occurs in configurations where foreign content is allowed, specifically when svg or math are in the list of allowed elements. This allows an attacker to bypass sanitization and inject arbitrary HTML, including JavaScript code, when an application sanitizes user input with a vulnerable configuration. The default configuration is not affected.

Recommendations For HtmlSanitizer versions prior to 8.0.723, update to version 8.0.723 or later. For HtmlSanitizer version 8.1.722-beta and earlier, update to a version later than 8.1.722-beta. As a temporary workaround, consider disallowing foreign elements svg and math to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-44390

GHSA-43CP-6P3Q-2PC4

Affected Products

Sanitize-Html

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44390.json · Exploit
• https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-43cp-6p3q-2pc4 · Vendor Advisory
• https://github.com/mganss/HtmlSanitizer/commit/ab29319866c020f0cc11e6b92228cd8039196c6e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-44390 · Security Note
• https://osv.dev/vulnerability/GHSA-43cp-6p3q-2pc4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44390 · Vendor Advisory
• https://github.com/mganss/HtmlSanitizer · Note
• https://twitter.com/CVEnew/status/1709929822376599860 · Twitter Post
• https://twitter.com/mdriyaz29/status/1709954418266042474 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1709969015320228263 · Twitter Post
• https://t.me/cibsecurity/71665 · Telegram Post