CVE-2024-34064 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

What is CVE-2024-34064?

CVE-2024-34064 is a medium-severity cross-site scripting vulnerability in Fedoraproject Fedora, published on 6 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.

Weakness: CWE-79

Which versions are affected by CVE-2024-34064?

3 open source packages ship an affected version, including jinja2 and Jinja2. It affects 2 products.

Products include Fedoraproject Fedora, Palletsprojects Jinja.

How do I fix CVE-2024-34064?

Upgrade jinja2 to 3.1.4 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-34064 being exploited?

There is no known exploitation of CVE-2024-34064 in the wild and no public exploit code.

Public exploit code: 7 proofs of concept on GitHub.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2024-34064, ALSA-2024:3820, ALSA-2024:4231, ALSA-2024:9150, AZL-40369, AZL-40420 and 27 more.