CVE-2016-9909

HTML5lib <0.99999999 XSS via '<' in attribute values

• CVSS 6.1
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Input Validation and Sanitization
• Remote

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.

CVE

CVE-2016-9909

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

6.1

Published

2017-02-22

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update html5lib to version 0.99999999 or higher.

import html5lib

parser = html5lib.HTMLParser(strict=False)

def parse(html):
    """Vulnerable function that demonstrates the security issue."""
    document = parser.parse(html)
    return document

html_input = '<div title="Test <script>alert(1)</script>"></div>'
document = parse(html_input)
print(document)

import html5lib
from html5lib import HTMLParser, treebuilders

parser = HTMLParser(
    tree=treebuilders.getTreeBuilder("dom"),
    namespaceHTMLElements=False,
    strict=True,
)

def parse(html):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents xss
    document = parser.parse(html)
    return document

html_input = '<div title="Test <script>alert(1)</script>"></div>'
document = parse(html_input)
print(document)

@misc{vaitp:cve20169909,
  title        = {{HTML5lib <0.99999999 XSS via '<' in attribute values}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2016-9909},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2016-9909/}}
}