CVE-2021-23980: XSS
Impact
A mutation XSS affects users calling bleach.clean with all of:
svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False
Note: none of the above tags are in the default allowed tags and stripcomments defaults to True.
Patches
Users are encouraged to upgrade to bleach v3.3.0 or greater.
Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.
Workarounds
modify bleach.clean calls to at least one of: not allow the style, title, noscript, script, textarea, noframes, iframe, or xmp tag not allow svg or math tags not allow p or br tags set stripcomments=True
A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
References
https://bugzilla.mozilla.org/showbug.cgi?id=1689399 https://advisory.checkmarx.net/advisory/CX-2021-4303 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980 https://cure53.de/fp170.pdf
Credits
Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by Michał Bentkowski at Securitum
For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Other sources
A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default allowed tags and stripcomments defaults to True.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-23980?
CVE-2021-23980 has been assigned a medium severity rating due to its potential for exploitation via mutation cross-site scripting.
How do I fix CVE-2021-23980?
To fix CVE-2021-23980, upgrade Bleach to version 3.3.0 or later.
Which versions of Bleach are affected by CVE-2021-23980?
CVE-2021-23980 affects versions of Bleach prior to 3.3.0.
What type of vulnerability is CVE-2021-23980?
CVE-2021-23980 is classified as a mutation cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2021-23980?
Any users or applications utilizing Bleach versions below 3.3.0 are at risk of CVE-2021-23980.