Vulnerability advisory
CVE-2022-23499
Cross-Site Scripting Protection bypass in HTML Sanitizer
Also known as GHSA-hvwx-qh2h-xcfj
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/typo3/html-sanitizer ↗ | |
| ca1c30b9b5c160024257f456606b1f3f17138ca6 through 37f1d10d762cf8019594ff596d9207f7551001ad | No fix listed |
| b32bbd462406f28d1fca4bde8a8cd8b49a4bdd39 to before f8b9c466a08fe4b7bd32b4b8dbde5cf7fbfa9956 | f8b9c466a08fe4b7bd32b4b8dbde5cf7fbfa9956 |
Also listed as affected (26)
| |
Description
HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (script, style, noframes, noembed and iframe) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that's why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. This issue has been fixed in versions 1.5.0 and 2.1.1.