Vulnerability GHSA-9jh8-v38h-cvhr
Summary
ammonia: mXSS via MathML `annotation-xml` encoding strip
Details
If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.
The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.
This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:
- User writes code like
<math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>. - Namespace filtering checks the DOM, and it passes.
<gadget>is parsed as HTML. - Attribute filter strips it down to
<math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone,<gadget>is now parsed as MathML. - The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.
Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:
- title
- textarea
- xmp
- iframe
- noembed
- noframes
- plaintext
- noscript
- style
- script
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.
Impact
Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.
Patches
- https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3)
- https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2)
- https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2)
Workarounds
Call builder.add_clean_content_tags("annotation-xml") to remove the annotation-xml element and all of its children, including the XSS gadget.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
