CVE-2024-52595

lxml_html_clean prior to 0.4.0 allows XSS via improper tag handling.

• CVSS 6.1
• CWE-79
• Input Validation and Sanitization
• Remote

lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `<svg>`, `<math>` and `<noscript>`. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the exploitation of this vulnerability. Via `remove_tags`, one may specify tags to remove – their content is moved to their parents' tags. Via `kill_tags`, one may specify tags to be removed completely. Via `allow_tags`, one may restrict the set of permissible tags, excluding context-switching tags like `<svg>`, `<math>` and `<noscript>`.

CVE

CVE-2024-52595

CWE

CWE-79

CVSS base score

6.1

Published

2024-11-19

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Data Theft

Affected component

lxml

Fixed by upgrading

Yes

Solution

Upgrade to lxml version 0.4.0 or later.

from lxml.html.clean import Cleaner

cleaner = Cleaner()

html_input = """
<div>
    <style>
        /* This is a CSS comment */
    </style>
    <script>alert('XSS');</script>
    <svg><text>Malicious SVG content</text></svg>
    <math><msup><mi>x</mi><mn>2</mn></msup></math>
    <noscript>This should not be rendered</noscript>
    <p>Safe content</p>
</div>
"""

cleaned_html = cleaner.clean_html(html_input)

print(cleaned_html)

from lxml.html.clean import Cleaner

cleaner = Cleaner(
    remove_tags=['svg', 'math', 'noscript'],
    kill_tags=['script'],
    allow_tags=['p', 'div', 'span', 'a']
)

html_input = """
<div>
    <style>
        /* This is a CSS comment */
    </style>
    <script>alert('XSS');</script>
    <svg><text>Malicious SVG content</text></svg>
    <math><msup><mi>x</mi><mn>2</mn></msup></math>
    <noscript>This should not be rendered</noscript>
    <p>Safe content</p>
</div>
"""

cleaned_html = cleaner.clean_html(html_input)

print(cleaned_html)

<style>
    body { background: red; }
    /*<script>alert('XSS');</script>*/
</style>
<div>
    <svg><text>Malicious content</text></svg>
    <math><mi>x</mi><mo>=</mo><mn>5</mn></math>
    <noscript><script>alert('XSS');</script></noscript>
</div>

@misc{vaitp:cve202452595,
  title        = {{lxml_html_clean prior to 0.4.0 allows XSS via improper tag handling.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-52595},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-52595/}}
}