CVE-2022-23499 Cross-Site Scripting Protection bypass in HTML Sanitizer

2022-12-1320:29:41

CWE-79

GitHub_M

www.cve.org

cve-2022-23499

cross-site scripting

html sanitizer

php

parsing issue

xss-safe markup

masterminds/html5

domtext nodes

upstream package

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

30.7%

JSON

HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (script, style, noframes, noembed and iframe) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that’s why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. This issue has been fixed in versions 1.5.0 and 2.1.1.

CNA Affected

[
  {
    "vendor": "TYPO3",
    "product": "html-sanitizer",
    "versions": [
      {
        "version": ">= 1.0.0, < 1.5.0",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.1.1",
        "status": "affected"
      }
    ]
  }
]