CVE-2020-6802: XSS
Impact
A mutation XSS affects users calling bleach.clean with noscript and a raw tag (see below) in the allowed/whitelisted tags option.
Patches
v3.1.1
Workarounds
modify bleach.clean calls to not whitelist noscript and one or more of the following raw tags:
title textarea script style noembed noframes iframe xmp
A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
References
https://bugzilla.mozilla.org/showbug.cgi?id=1615315 https://cure53.de/fp170.pdf https://nvd.nist.gov/vuln/detail/CVE-2020-6802 https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
Credits
Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx
For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Other sources
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/bleachto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
mozilla/bleachto a version that resolves this vulnerability.Fixed in 3.11 - Configuration
Modify `bleach.clean` calls to not whitelist `noscript` and one or more of the following raw tags: `iframe`, `noembed`, `noframes`, `script`, `style`, `textarea`, `title`, `v3.1.1`, `xmp`.
Mozilla Bleach allowed/whitelisted tags option = do not whitelist `noscript` and do not whitelist any of the listed raw tags: `iframe`, `noembed`, `noframes`, `script`, `style`, `textarea`, `title`, `v3.1.1`, `xmp` - Compensating control
Deploy a strong Content-Security-Policy (CSP) with `script-src` that does not include `unsafe-inline` and `unsafe-eval` to mitigate the risk of mutation XSS.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-6802?
CVE-2020-6802 is considered a moderate vulnerability, specifically a mutation XSS that can affect user input validation in certain contexts.
How do I fix CVE-2020-6802?
To fix CVE-2020-6802, upgrade to Bleach version 3.1.1 or later.
What software is impacted by CVE-2020-6802?
CVE-2020-6802 affects Bleach version 3.1.1 and earlier as well as several Fedora releases including versions 30, 31, and 32.
What workaround exists for CVE-2020-6802?
A workaround for CVE-2020-6802 is to modify calls to bleach.clean to avoid whitelisting the noscript tag.
Is user data at risk due to CVE-2020-6802?
Yes, user data is at risk as CVE-2020-6802 allows for potential XSS attacks through improper validation of input when using whitelisted tags.