CVE-2021-35043

Vulnerability

OWASP AntiSamy versions before 1.6.4 are vulnerable to cross-site scripting (XSS) when using the HTML output serializer. The issue lies in the handling of HTML attributes: an attacker can bypass sanitization by encoding the colon character in a javascript: URL using HTML numeric entities such as &#00058. This allows injection of arbitrary JavaScript. The XHTML serializer is not affected. [1][2]

Exploitation

An attacker can craft a malicious HTML attribute, for example an href value, containing javascript:&#00058alert(1). When AntiSamy processes this input using the HTML output serializer, it fails to recognize the encoded colon as part of a dangerous scheme and outputs the attribute without proper sanitization. The attacker does not require authentication; the attack is triggered when a victim views the sanitized HTML in a browser. [2][4]

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to theft of cookies, session tokens, or other sensitive data, as well as defacement or redirection to malicious sites. The impact is consistent with stored or reflected XSS, depending on how the sanitized output is used. [2]

Mitigation

The vulnerability is fixed in AntiSamy version 1.6.4, released on July 19, 2021 [3]. Users should upgrade to at least version 1.6.4. No workarounds are documented; the fix addresses the encoding bypass in the HTML output serializer. [3][4]