PT-2024-35391 · Lxml+1 · Lxml+1

Jorianwoltjer · Published 2024-11-19 · Updated 2024-12-13 · CVE-2024-52595

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions lxml html clean versions prior to 0.4.0

Description The HTML Parser in lxml does not properly handle context-switching for special HTML tags such as <svg>, <math>, and <noscript>. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml html clean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxml html clean in default configuration for sanitizing untrusted HTML content.

Recommendations For versions prior to 0.4.0, upgrade to lxml 0.4.0 to address this issue. As a temporary mitigation, configure lxml html clean with the following settings:

• Use remove tags to specify tags to remove, moving their content to their parents' tags.
• Use kill tags to specify tags to be removed completely.
• Use allow tags to restrict the set of permissible tags, excluding context-switching tags like <svg>, <math>, and <noscript>.

Exploit

Fix

XSS

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-83

CWE-79

CWE-184

Related Identifiers

CVE-2024-52595

GHSA-5JFW-GQ64-Q45F

PYSEC-2024-160

Affected Products

Lxml

Lxml Html Clean

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52595.json · Exploit
• https://github.com/fedora-python/lxml_html_clean/pull/19 · Patch
• https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-5jfw-gq64-q45f · Vendor Advisory
• https://github.com/fedora-python/lxml_html_clean/commit/c5d816f86eb3707d72a8ecf5f3823e0daa1b3808 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-52595 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-52595 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-52595 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5jfw-gq64-q45f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52595 · Security Note
• https://ubuntu.com/security/CVE-2024-52595 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-160 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52595 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-52595 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/lxml-html-clean/PYSEC-2024-160.yaml · Note
• https://github.com/fedora-python/lxml_html_clean · Note