Impact
A mutation XSS affects users calling bleach.clean with all of:
the svg or math in the allowed/whitelisted tags an RCDATA tag (see below) in the allowed/whitelisted tags the keyword argument strip=False
Patches
Users are encouraged to upgrade to bleach v3.1.2 or greater.
Workarounds
modify bleach.clean calls to use strip=True, or not whitelist math or svg tags and one or more of the following tags:
script noscript style noframes xmp noembed iframe
A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
References
https://bugzilla.mozilla.org/showbug.cgi?id=1621692 https://cure53.de/fp170.pdf https://nvd.nist.gov/vuln/detail/CVE-2020-6816 https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
Credits
Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx
For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Impact
A mutation XSS affects users calling bleach.clean with noscript and a raw tag (see below) in the allowed/whitelisted tags option.
Patches
v3.1.1
Workarounds
modify bleach.clean calls to not whitelist noscript and one or more of the following raw tags:
title textarea script style noembed noframes iframe xmp
A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
References
https://bugzilla.mozilla.org/showbug.cgi?id=1615315 https://cure53.de/fp170.pdf https://nvd.nist.gov/vuln/detail/CVE-2020-6802 https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
Credits
Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx
For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Impact
A mutation XSS affects users calling bleach.clean with all of:
svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False
Note: none of the above tags are in the default allowed tags and stripcomments defaults to True.
Patches
Users are encouraged to upgrade to bleach v3.3.0 or greater.
Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.
Workarounds
modify bleach.clean calls to at least one of: not allow the style, title, noscript, script, textarea, noframes, iframe, or xmp tag not allow svg or math tags not allow p or br tags set stripcomments=True
A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
References
https://bugzilla.mozilla.org/showbug.cgi?id=1689399 https://advisory.checkmarx.net/advisory/CX-2021-4303 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980 https://cure53.de/fp170.pdf
Credits
Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by Michał Bentkowski at Securitum
For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org