CVE-2024-22195

Jinja xmlattr filter abuse XSS

• CVSS 6.1
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Configuration Issues
• Remote

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

CVE

CVE-2024-22195

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

6.1

Published

2024-01-11

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Configuration Issues

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update pallets/jinja to version 3.1.3 or later

from jinja2 import Environment

env = Environment(autoescape=False)

template = env.from_string("""
<div {{ attributes | xmlattr }}></div>
""")

attributes = {
    'onclick': 'alert("XSS Attack!")',
    'style': 'background-color: red;'
}

rendered = template.render(attributes=attributes)
print(rendered)

from jinja2 import Environment, escape

env = Environment(autoescape=True)

template = env.from_string("""
<div {{ attributes | xmlattr }}></div>
""")

attributes = {
    'onclick': 'alert("XSS Attack!")',
    'style': 'background-color: red;'
}

rendered = template.render(attributes=' '.join(f'{key}="{value}"' for key, value in attributes.items()))
print(rendered)

@misc{vaitp:cve202422195,
  title        = {{Jinja xmlattr filter abuse XSS}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-22195},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-22195/}}
}