GoogleOSV:GHSA-Q65M-PV3F-WR5RXSS in Bleach when noscript and raw tag whitelisted
0.004 Low
EPSS
Percentile
74.7%
Impact
A mutation XSS affects users calling bleach.clean with noscript and a raw tag (see below) in the allowed/whitelisted tags option.
Patches
v3.1.1
Workarounds
- modify
bleach.cleancalls to not whitelistnoscriptand one or more of the following raw tags:
title
textarea
script
style
noembed
noframes
iframe
xmp
- A strong Content-Security-Policy without
unsafe-inlineandunsafe-evalscript-srcs) will also help mitigate the risk.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1615315
- https://cure53.de/fp170.pdf
- https://nvd.nist.gov/vuln/detail/CVE-2020-6802
- https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
Credits
- Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx
For more information
If you have any questions or comments about this advisory:
- Open an issue at https://github.com/mozilla/bleach/issues
- Email us at [email protected]
References
advisory.checkmarx.net/advisory/CX-2020-4276
bugzilla.mozilla.org/show_bug.cgi?id=1615315
cure53.de/fp170.pdf
github.com/mozilla/bleach
github.com/mozilla/bleach/commit/f77e0f6392177a06e46a49abd61a4d9f035e57fd
github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
lists.fedoraproject.org/archives/list/[email protected]/message/72R4VFFHDRSQMNT7IZU3X2755ZP4HGNI
lists.fedoraproject.org/archives/list/[email protected]/message/OCNLM2MGQTOLCIVVYS2Z5S7KOQJR5JC4
lists.fedoraproject.org/archives/list/[email protected]/message/YTULPQB7HVPPYWEYVNHJGDTSPVIDHIZX
nvd.nist.gov/vuln/detail/CVE-2020-6802
www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
Related
