PT-2021-31151

Published

2021-10-10

·

Updated

2021-10-10

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS.
The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.
xml
<svg xmlns="http://www.w3.org/2000/svg">
 <a>
  <animateMotion attributeName="href" to="javascript:alert('SET XSS')"></animateMotion>
  <text y="30">Click set</text>
 </a>
</svg>
Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.
This vulnerability was reported by ucsurf.
Vendors
Affected products
Related identifiers
RUSTSEC-2021-0158
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com