CVE-2018-7753 Bleach URI Scheme Restriction Bypass

Critical 9.8 Published 7 Mar 2018 Updated 17 Sep 2024

Attackers can bypass URI sanitization in Bleach using character entities to inject malicious scripts, leading to cross-site scripting attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-7753?

CVE-2018-7753 is a critical cross-site scripting vulnerability in n/a, published on 7 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.

Weakness: CWE-20

Which versions are affected by CVE-2018-7753?

3 open source packages ship an affected version, including bleach. It affects 1 product.

Package	Affected	Fixed in
`bleach` PyPI	From `2.1`	`2.1.3`
`bleach` PyPI	From `2.1.0`	`2.1.3`
`bleach` PyPI	From `2.1.0`	`2.1.3`

Products include Mozilla Bleach.

How do I fix CVE-2018-7753?

Upgrade bleach to 2.1.3 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-7753 being exploited?

There is no known exploitation of CVE-2018-7753 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2018-7753, GHSA-m9mq-p2f9-cfqv, PYSEC-2018-51, UBUNTU-CVE-2018-7753.