PT-2023-8390 · Antisamy+1 · Antisamy+1

Leen · Published 2023-10-09 · Updated 2024-01-16 · CVE-2023-43643

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions AntiSamy versions prior to 1.7.4

Description The issue is related to a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability, the preserveComments directive must be enabled in the policy file and certain tags must be allowed at the same time. This can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output.

Recommendations For versions prior to 1.7.4, update to AntiSamy 1.7.4 or later to resolve the issue. As a temporary workaround, manually edit the AntiSamy policy file by deleting the preserveComments directive or setting its value to false, if present. Additionally, consider adding a tag definition to remove the noscript tag under the <tagrules> node.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-00589

CVE-2023-43643

GHSA-PCF2-GH6G-H5R2

Affected Products

Antisamy

Debian

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43643.json · Exploit
• 🔥 https://github.com/nahsra/antisamy/security/advisories/GHSA-pcf2-gh6g-h5r2 · Exploit
• https://github.com/nahsra/antisamy/releases/tag/v1.7.4 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-43643 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-43643 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43643 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-43643 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00589 · Security Note
• https://osv.dev/vulnerability/GHSA-pcf2-gh6g-h5r2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43643 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-43643 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-43643 · Vendor Advisory
• https://github.com/nahsra/antisamy/commit/05c52b98bb845b8175b8406bd2f391ce334a05d6 · Note
• https://github.com/nahsra/antisamy · Note
• https://vuldb.com/ru/?id.251191 · Note