GHSA-9jh8-v38h-cvhr: XSS
If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.
The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.
This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:
1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>. 2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML. 3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML. 4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.
Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These [elements] are:
title textarea xmp iframe noembed noframes plaintext noscript style script
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.
[elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/treebuilder/rules.rs
Impact
Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.
Patches
- https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3) - https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2) - https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2)
Workarounds
Call <code>builder.addcleancontenttags("annotation-xml")</code> to remove the annotation-xml element and all of its children, including the XSS gadget.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 3.3.2 - Upgrade
Upgrade
rust-ammonia/ammoniato a version that resolves this vulnerability.Fixed in 3.3.2 - Upgrade
Upgrade
rust-ammonia/ammoniato a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
rust-ammonia/ammoniato a version that resolves this vulnerability.Fixed in 4.1.3 - Configuration
Call builder.add_clean_content_tags("annotation-xml") to remove the annotation-xml element and all of its children, including the XSS gadget.
ammonia add_clean_content_tags = annotation-xml
Event History
Frequently Asked Questions
Which sanitizer configurations are exposed?
The issue affects configurations that allow both the math and annotation-xml tags while disallowing the encoding attribute. The described attack does not take effect unless all of those conditions are present.
What must an attacker be able to control?
An attacker must be able to submit HTML or MathML content that is processed by the sanitizer and later rendered in a user's browser. The payload must use annotation-xml with an encoding value that is removed by attribute filtering, causing a parser-context change after sanitization.
How can I determine whether my application is affected?
Review the Ammonia tag and attribute allowlists used for untrusted content. The relevant combination is allowing math and annotation-xml while excluding the encoding attribute; payloads also require an HTML raw-text element such as title, textarea, xmp, iframe, noembed, noframes, plaintext, noscript, style, or script.