CVE-2016-9910

Pre-0.99999999 HTML5lib XSS issue: mishandling attribute values

• CVSS 6.1
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Input Validation and Sanitization
• Remote

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909.

CVE

CVE-2016-9910

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

6.1

Published

2017-02-22

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update html5lib to version 0.99999999 or higher.

import html5lib

parser = html5lib.HTMLParser(strict=False)

html_input = '<div data-attr="<script>alert(1)</script>">Hello</div>'

document = parser.parse(html_input)

print(document)

import html5lib
from html5lib import HTMLParser, treebuilders

parser = HTMLParser(
    tree=treebuilders.getTreeBuilder("dom"),
    namespaceHTMLElements=False,
    strict=True,
)

def parse(html):
    document = parser.parse(html)
    return document

html_input = '<div data-attr="<script>alert(1)</script>">Hello</div>'
document = parse(html_input)

print(document)

@misc{vaitp:cve20169910,
  title        = {{Pre-0.99999999 HTML5lib XSS issue: mishandling attribute values}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2016-9910},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2016-9910/}}
}