Impact
A mutation XSS affects users calling bleach.clean with all of:
the svg or math in the allowed/whitelisted tags an RCDATA tag (see below) in the allowed/whitelisted tags the keyword argument strip=False
Patches
Users are encouraged to upgrade to bleach v3.1.2 or greater.
Workarounds
modify bleach.clean calls to use strip=True, or not whitelist math or svg tags and one or more of the following tags:
script noscript style noframes xmp noembed iframe
A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
References
https://bugzilla.mozilla.org/showbug.cgi?id=1621692 https://cure53.de/fp170.pdf https://nvd.nist.gov/vuln/detail/CVE-2020-6816 https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
Credits
Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx
For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Impact
A mutation XSS affects users calling bleach.clean with noscript and a raw tag (see below) in the allowed/whitelisted tags option.
Patches
v3.1.1
Workarounds
modify bleach.clean calls to not whitelist noscript and one or more of the following raw tags:
title textarea script style noembed noframes iframe xmp
A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
References
https://bugzilla.mozilla.org/showbug.cgi?id=1615315 https://cure53.de/fp170.pdf https://nvd.nist.gov/vuln/detail/CVE-2020-6802 https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
Credits
Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx
For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
Impact
A mutation XSS affects users calling bleach.clean with all of:
svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False
Note: none of the above tags are in the default allowed tags and stripcomments defaults to True.
Patches
Users are encouraged to upgrade to bleach v3.3.0 or greater.
Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.
Workarounds
modify bleach.clean calls to at least one of: not allow the style, title, noscript, script, textarea, noframes, iframe, or xmp tag not allow svg or math tags not allow p or br tags set stripcomments=True
A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
References
https://bugzilla.mozilla.org/showbug.cgi?id=1689399 https://advisory.checkmarx.net/advisory/CX-2021-4303 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980 https://cure53.de/fp170.pdf
Credits
Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by Michał Bentkowski at Securitum
For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Impact
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
Patches
3.1.4
Workarounds
do not whitelist the style attribute in bleach.clean calls
limit input string length
References
https://bugzilla.mozilla.org/showbug.cgi?id=1623633 https://www.regular-expressions.info/redos.html https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817
Credits
Reported by schwag09 of r2c
For more information If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org