CVE-2021-23899: OWASP Json-Sanitizer XSS Vulnerability

CVE-2021-23899 Overview

CVE-2021-23899 is a critical injection vulnerability affecting OWASP json-sanitizer versions prior to 1.2.2. The vulnerability allows an attacker to inject arbitrary HTML or XML content into embedding documents through crafted input that causes the sanitizer to emit closing SCRIPT tags and CDATA section delimiters. This improper neutralization of special elements can lead to Cross-Site Scripting (XSS) attacks and other injection-based exploits when the sanitized JSON is embedded in HTML or XML documents.

Critical Impact

Attackers can inject arbitrary HTML or XML content into documents that embed json-sanitizer output, potentially leading to XSS attacks, session hijacking, and unauthorized data access.

Affected Products

• OWASP json-sanitizer versions prior to 1.2.2

Discovery Timeline

• 2021-01-13 - CVE-2021-23899 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-23899

Vulnerability Analysis

The OWASP json-sanitizer library is designed to sanitize JSON content to make it safe for embedding in HTML and XML documents. However, versions before 1.2.2 contain a flaw in how certain special character sequences are processed. When handling crafted input, the library may inadvertently emit closing </SCRIPT> tags or CDATA section delimiters (]]>) within the output.

This behavior is particularly dangerous because the json-sanitizer is specifically intended to produce output safe for embedding in script contexts. When closing script tags or CDATA delimiters escape sanitization, an attacker can break out of the intended context and inject malicious content directly into the hosting document.

The vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference), though the attack surface extends beyond pure XXE to include HTML injection scenarios common in web applications that embed JSON data within script tags.

Root Cause

The root cause lies in insufficient handling of special delimiter sequences within the json-sanitizer's output encoding logic. The library failed to properly escape or neutralize character sequences that function as context terminators in HTML (</SCRIPT>) and XML (]]>) documents. When malicious input containing these sequences is processed, they pass through to the output, allowing attackers to prematurely close the embedding context.

Attack Vector

This vulnerability is exploitable over the network without any authentication or user interaction requirements. An attacker can submit specially crafted JSON input to an application using a vulnerable version of json-sanitizer. When the sanitized output is embedded in an HTML page within a <script> tag or in an XML document within a CDATA section, the attacker-controlled closing delimiters terminate the legitimate context.

From that point, the attacker can inject arbitrary HTML elements, JavaScript code, or XML content. In a typical web application scenario, this could lead to stored or reflected XSS attacks, enabling session hijacking, credential theft, defacement, or malware distribution to end users.

The attack requires no special privileges and can be executed by any user capable of submitting input that will be processed by the vulnerable sanitizer and subsequently embedded in a document served to victims.

Detection Methods for CVE-2021-23899

Indicators of Compromise

• Unusual JSON responses containing </script> or ]]> sequences in unexpected locations
• Web application logs showing crafted input strings designed to break out of script or CDATA contexts
• Client-side errors or unexpected script termination in pages embedding sanitized JSON
• Reports of XSS attacks originating from JSON-embedded content

Detection Strategies

• Review application dependencies to identify usage of OWASP json-sanitizer versions prior to 1.2.2
• Implement Web Application Firewall (WAF) rules to detect attempts to inject </script> or ]]> sequences in JSON input
• Deploy Content Security Policy (CSP) headers to mitigate the impact of successful injection attacks
• Monitor application logs for patterns indicative of injection attempts targeting JSON handling

Monitoring Recommendations

• Enable verbose logging for JSON processing components to capture suspicious input patterns
• Implement real-time alerting on WAF detections related to script injection attempts
• Establish baseline behavior for JSON endpoints and alert on anomalous input patterns
• Utilize Software Composition Analysis (SCA) tools to continuously monitor for vulnerable dependencies

How to Mitigate CVE-2021-23899

Immediate Actions Required

• Upgrade OWASP json-sanitizer to version 1.2.2 or later immediately
• Audit all applications using json-sanitizer to identify vulnerable deployments
• Implement additional output encoding when embedding sanitized JSON in HTML or XML as a defense-in-depth measure
• Review application logs for evidence of exploitation attempts

Patch Information

OWASP has released version 1.2.2 of json-sanitizer which addresses this vulnerability. The fix ensures that closing SCRIPT tags and CDATA section delimiters are properly escaped in the output. The patch can be reviewed in the GitHub commit and the full changes between versions are available in the version comparison.

For Maven-based projects, update your pom.xml to specify version 1.2.2 or later. For Gradle projects, update your dependency declaration accordingly.

Workarounds

• If immediate upgrade is not possible, implement additional server-side output encoding that specifically targets </script> and ]]> sequences before embedding json-sanitizer output
• Use Content Security Policy headers with strict script-src directives to limit the impact of successful injections
• Consider isolating JSON data in separate endpoints rather than embedding directly in HTML documents
• Implement input validation to reject or sanitize input containing suspicious delimiter sequences before processing

# Maven dependency update example
# Update pom.xml to use patched version
mvn versions:use-latest-releases -Dincludes=com.mikesamuel:json-sanitizer
mvn dependency:tree | grep json-sanitizer
# Verify version is 1.2.2 or later