GHSA-5jfw-gq64-q45f

Suggest an improvement
Source
https://github.com/advisories/GHSA-5jfw-gq64-q45f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-5jfw-gq64-q45f/GHSA-5jfw-gq64-q45f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5jfw-gq64-q45f
Aliases
  • CVE-2024-52595
Published
2024-11-19T21:07:59Z
Modified
2024-11-20T17:01:38.698386Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H CVSS Calculator
Summary
HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through
Details

Impact

The HTML Parser in lxml does not properly handle context-switching for special HTML tags such as <svg>, <math> and <noscript>. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxmlhtmlclean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxmlhtmlclean in default configuration for sanitizing untrusted HTML content.

Patches

Users employing the HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue.

Workarounds

As a temporary mitigation, users can configure lxmlhtmlclean with the following settings to prevent the exploitation of this vulnerability: * remove_tags: Specify tags to remove - their content is moved to their parents' tags. * kill_tags: Specify tags to be removed completely. * allow_tags: Restrict the set of permissible tags, excluding context-switching tags like <svg>, <math> and <noscript>.

References

  • https://github.com/fedora-python/lxmlhtmlclean/pull/19
  • https://github.com/fedora-python/lxmlhtmlclean/pull/19/commits/c5d816f86eb3707d72a8ecf5f3823e0daa1b3808
Database specific
{
    "nvd_published_at": "2024-11-19T22:15:21Z",
    "cwe_ids": [
        "CWE-184",
        "CWE-79",
        "CWE-83"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-19T21:07:59Z"
}
References

Affected packages

PyPI / lxml-html-clean

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.0

Affected versions

0.*

0.1.0
0.1.1
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1