PT-2023-9150 · Owasp · Owasp Antisamy .Net

Leen · Published 2023-12-20 · Updated 2024-01-08 · CVE-2023-51652

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OWASP AntiSamy .NET versions prior to 1.2.0

Description The issue is related to a mutation cross-site scripting (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. This vulnerability can be exploited when the preserveComments directive is enabled in the policy file and certain tags are allowed. As a result, elements in comment tags can be interpreted as executable when using AntiSamy's sanitized output.

Recommendations To resolve the issue, upgrade to OWASP AntiSamy .NET version 1.2.0 or later. As a temporary workaround, manually edit the AntiSamy policy file (e.g., antisamy.xml) by deleting the preserveComments directive or setting its value to false, if present. Also, consider making AntiSamy remove the noscript tag by adding a line to the tag definitions under the <tagrules> node, or deleting it entirely if present.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-04170

CVE-2023-51652

GHSA-8X6F-956F-Q43W

Affected Products

Owasp Antisamy .Net

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51652.json · Exploit
• https://github.com/spassarop/antisamy-dotnet/commit/8117911933e75a25cd0054ef017577486338444a · Patch
• https://github.com/spassarop/antisamy-dotnet/security/advisories/GHSA-8x6f-956f-q43w · Vendor Advisory
• https://github.com/spassarop/antisamy-dotnet/commit/7e500daef6ad9c10e97c68feab78f4cb6e3083c6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-51652 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51652 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8x6f-956f-q43w · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04170 · Security Note
• https://github.com/spassarop/antisamy-dotnet · Note
• https://twitter.com/VulmonFeeds/status/1742295508972925377 · Twitter Post
• https://vuldb.com/?id.249520 · Note
• https://t.me/cibsecurity/74194 · Telegram Post
• https://twitter.com/CVEnew/status/1742281834569109737 · Twitter Post