PT-2023-8924

CVE-2023-36823

Publicado

2023-07-06

Atualizado

2024-04-24

Descrição por

CVSS 2.0

7.5

Alta

MétricasAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sanitize versions 3.0.0 through 6.0.2

Description The issue is related to the Sanitize HTML and CSS sanitizer, which can be exploited by an attacker using carefully crafted input to sneak arbitrary HTML and CSS through the sanitizer. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. The exploitation is possible when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows style elements and one or more CSS at-rules.

Recommendations For Sanitize versions 3.0.0 through 6.0.2, consider the following:

Upgrade to Sanitize version 6.0.2 or later, which performs additional escaping of CSS in style element content.
Use a Sanitize config that doesn't allow style elements.
Use a Sanitize config that doesn't allow CSS at-rules.
Manually escape the character sequence </ as </ in style element content.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Cure53

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados

CVE-2023-36823