RUSTSEC-2021-0157 Incorrect escaping for `url("")` functions in CSS style attributes
Incorrect escaping in CSS url() functions allows CSS injection, potentially leading to XSS, when style attributes are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is RUSTSEC-2021-0157?
RUSTSEC-2021-0157 is a cross-site scripting vulnerability in ammonia, published on 10 Oct 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.
As an example, this snippet:
<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>
Would erroneously "sanitize" to:
<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>
This vulnerability was reported by Uttej Badwane
Which versions are affected by RUSTSEC-2021-0157?
1 open source package ship an affected version, including ammonia.
| Package | Affected | Fixed in |
|---|---|---|
ammonia crates.io | From 0.0.0-0 | 4.1.7, 4.2.3 |
How do I fix RUSTSEC-2021-0157?
Upgrade ammonia to a fixed version for your release line: 4.1.7 or 4.2.3.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is RUSTSEC-2021-0157 being exploited?
There is no known exploitation of RUSTSEC-2021-0157 in the wild and no public exploit code.
Sources
Also known as GHSA-69v2-w9vg-4g83.