CVE-2024-23635 AntiSamy malicious input can provoke XSS when preserving comments

What is CVE-2024-23635?

CVE-2024-23635 is a medium-severity cross-site scripting vulnerability in nahsra antisamy, published on 2 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patched in AntiSamy 1.7.5 and later.

Weakness: CWE-79

Which versions are affected by CVE-2024-23635?

2 open source packages ship an affected version, including org.owasp.antisamy:antisamy. It affects 1 product.

Products include Antisamy Project Antisamy.

How do I fix CVE-2024-23635?

Upgrade org.owasp.antisamy:antisamy to 1.7.5 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-23635 being exploited?

There is no known exploitation of CVE-2024-23635 in the wild and no public exploit code.

Other vulnerabilities in nahsra antisamy

• CVE-2022-28366 Denial of service in HtmlUnit-Neko High 7.5
• CVE-2023-43643 mXSS in AntiSamy Medium 6.1
• CVE-2022-28367 Cross-site Scripting in OWASP AntiSamy Medium 6.1
• CVE-2022-29577 Cross-site Scripting in OWASP AntiSamy Medium 6.1
• CVE-2021-35043 Cross-site Scripting in OWASP AntiSamy Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2024-23635, GHSA-2mrq-w8pv-5pvq, UBUNTU-CVE-2024-23635.