CVE-2009-3724
python-markdown2 before 1.0.1.14 has multiple XSS vulnerabilities
- CVSS 6.1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Configuration Issues
- Remote
python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.
- CVSS base score
- 6.1
- Published
- 2020-01-15
- OWASP
- A03 Injection
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Configuration Issues
- Subcategory
- Cross-Site Scripting (XSS)
- Accessibility scope
- Remote
- Impact
- Arbitrary Code Execution
- Fixed by upgrading
- Yes
Solution
Update python-markdown2 to version 1.0.1.14 or higher.
Vulnerable code sample
# VULNERABLE: Markdown XSS injection
import markdown
from flask import Flask, request, render_template_string
app = Flask(__name__)
@app.route('/preview', methods=['POST'])
def preview_markdown():
"""VULNERABLE: Processes markdown without sanitization."""
user_markdown = request.form.get('content', '')
# VULNERABILITY: Direct markdown processing allows XSS
# Malicious input: [Click me](javascript:alert('XSS'))
html_content = markdown.markdown(user_markdown, extensions=['extra'])
# VULNERABILITY: Unsafe template rendering
template = f'<html><body><div>{html_content}</div></body></html>'
return render_template_string(template)Patched code sample
# SECURE: Safe markdown processing with XSS prevention
import markdown
import bleach
from flask import Flask, request, render_template_string
from markupsafe import Markup
app = Flask(__name__)
# Define allowed HTML tags and attributes
ALLOWED_TAGS = ['h1', 'h2', 'h3', 'p', 'br', 'strong', 'em', 'ul', 'ol', 'li', 'a']
ALLOWED_ATTRIBUTES = {'a': ['href', 'title'], '*': ['class']}
ALLOWED_PROTOCOLS = ['http', 'https', 'mailto']
@app.route('/preview', methods=['POST'])
def preview_markdown():
"""SECURE: Processes markdown with proper sanitization."""
user_markdown = request.form.get('content', '')
# Input validation
if len(user_markdown) > 10000:
return "Content too long", 400
# Convert markdown to HTML
html_content = markdown.markdown(user_markdown, extensions=['extra'])
# SECURITY: Sanitize HTML to prevent XSS
clean_html = bleach.clean(
html_content,
tags=ALLOWED_TAGS,
attributes=ALLOWED_ATTRIBUTES,
protocols=ALLOWED_PROTOCOLS,
strip=True
)
# SECURITY: Use safe template rendering
template = '<html><body><div>{{ content|safe }}</div></body></html>'
return render_template_string(template, content=Markup(clean_html))Cite this entry
@misc{vaitp:cve20093724,
title = {{python-markdown2 before 1.0.1.14 has multiple XSS vulnerabilities}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2020},
note = {VAITP Python Vulnerability Dataset, entry CVE-2009-3724},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2009-3724/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::