CVE-2021-28957

XSS vulnerability in python-lxml (before 4.6.3) clean module

• CVSS 6.1
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Input Validation and Sanitization
• Remote

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

CVE

CVE-2021-28957

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

6.1

Published

2021-03-21

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update python-lxml to version 4.6.3 or higher.

from lxml.html.clean import Cleaner

cleaner = Cleaner(safe_attrs_only=False, forms=False)

html = '<form action="http://example.com" formaction="javascript:alert(\'XSS\')">Submit</form>'

cleaned_html = cleaner.clean_html(html)

print(cleaned_html)

from lxml.html.clean import Cleaner

cleaner = Cleaner(safe_attrs_only=True, forms=True)

html = '<form action="http://example.com" formaction="javascript:alert(\'XSS\')">Submit</form>'

cleaned_html = cleaner.clean_html(html)

print(cleaned_html)

@misc{vaitp:cve202128957,
  title        = {{XSS vulnerability in python-lxml (before 4.6.3) clean module}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-28957},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-28957/}}
}