CVE-2023-43643: AntiSamy Library mXSS Vulnerability

CVE-2023-43643 Overview

CVE-2023-43643 is a mutation XSS (mXSS) vulnerability in AntiSamy, a widely-used library for performing fast, configurable cleansing of HTML from untrusted sources. Prior to version 1.7.4, flawed parsing of HTML being sanitized can allow attackers to bypass sanitization controls when specific configuration options are enabled. This vulnerability affects applications that rely on AntiSamy to protect against cross-site scripting attacks.

Critical Impact

When the preserveComments directive is enabled in the policy file alongside certain permitted tags, crafted malicious inputs can cause elements within comment tags to be interpreted as executable code, completely bypassing the HTML sanitization intended to prevent XSS attacks.

Affected Products

• AntiSamy versions prior to 1.7.4
• Applications using AntiSamy with preserveComments directive enabled
• Web applications relying on AntiSamy for HTML sanitization with permissive tag policies

Discovery Timeline

• 2023-10-09 - CVE-2023-43643 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-43643

Vulnerability Analysis

This mutation XSS vulnerability arises from inconsistencies in how AntiSamy parses and processes HTML content, particularly within comment blocks. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which covers cross-site scripting vulnerabilities.

The flaw specifically manifests when the preserveComments configuration directive is enabled in the AntiSamy policy file. Under these conditions, the parsing logic fails to properly handle certain edge cases where HTML elements embedded within comment tags can "mutate" during the sanitization process. This mutation causes content that was originally inside comments (and thus seemingly harmless) to break out of the comment context and become executable HTML/JavaScript in the sanitized output.

The attack requires user interaction (a user must view the page containing the sanitized but malicious content), and successful exploitation can lead to limited confidentiality and integrity impacts through client-side script execution.

Root Cause

The root cause of CVE-2023-43643 lies in the HTML parsing logic within AntiSamy that handles comment preservation. When preserveComments is enabled, the parser attempts to maintain HTML comments in the sanitized output. However, the interaction between comment preservation and the allowlist of permitted HTML tags creates a parsing discrepancy.

Specifically, certain crafted input patterns can exploit differences between how AntiSamy's parser interprets the HTML structure versus how web browsers ultimately render the sanitized output. This parser differential allows malicious content to appear benign during sanitization but become active when rendered in the browser context.

Attack Vector

The attack vector is network-based, requiring an attacker to submit malicious HTML content to an application that uses AntiSamy for sanitization. The attack requires the following preconditions:

1. The target application must use AntiSamy for HTML sanitization
2. The AntiSamy policy must have preserveComments directive enabled
3. The policy must allow certain HTML tags that facilitate the mutation
4. A victim must view the page containing the sanitized output

The attacker crafts an HTML payload that leverages the parsing inconsistency. During sanitization, the payload passes through AntiSamy's checks because the malicious elements appear to be within comments. However, when the browser renders the sanitized HTML, the content "mutates" and breaks out of the comment context, executing as active HTML or JavaScript.

Since no verified code examples are available for this vulnerability, organizations should review the GitHub Security Advisory GHSA-pcf2-gh6g-h5r2 for technical details on the specific payload patterns that can trigger this vulnerability.

Detection Methods for CVE-2023-43643

Indicators of Compromise

• Unusual HTML comment patterns in user-submitted content that contain nested angle brackets or script-like syntax
• Web application logs showing HTML submissions with complex comment structures designed to confuse parsers
• Client-side script execution errors or unexpected behavior in browsers rendering AntiSamy-sanitized content
• Detection of XSS payloads in sanitized output that should have been filtered

Detection Strategies

• Implement application-level logging to capture and analyze HTML content before and after AntiSamy sanitization
• Deploy Web Application Firewalls (WAF) with rules to detect mutation XSS patterns and suspicious comment structures
• Use browser-based XSS auditing tools to test sanitized output for executable content
• Perform regular security scanning of applications using AntiSamy to identify mXSS bypass attempts

Monitoring Recommendations

• Monitor application logs for repeated attempts to submit complex HTML with unusual comment nesting patterns
• Set up alerts for any JavaScript execution in contexts where only sanitized HTML should be rendered
• Track AntiSamy library versions across your application inventory to ensure vulnerable versions are identified
• Implement Content Security Policy (CSP) headers and monitor for CSP violations that may indicate XSS attempts

How to Mitigate CVE-2023-43643

Immediate Actions Required

• Upgrade AntiSamy to version 1.7.4 or later immediately across all affected applications
• Review AntiSamy policy files and disable the preserveComments directive if not strictly required
• Audit applications using AntiSamy to understand the scope of potential exposure
• Implement additional output encoding as a defense-in-depth measure

Patch Information

The AntiSamy development team has addressed this vulnerability in version 1.7.4. Organizations should update their AntiSamy dependency to this version or later. The patch corrects the HTML parsing logic to properly handle comment preservation without allowing mutation XSS attacks.

For detailed patch information and release notes, refer to the AntiSamy v1.7.4 Release on GitHub.

Workarounds

• Disable the preserveComments directive in your AntiSamy policy file if comment preservation is not a business requirement
• Implement strict Content Security Policy (CSP) headers to mitigate the impact of any XSS that might bypass sanitization
• Add an additional layer of output encoding after AntiSamy sanitization as a defense-in-depth measure
• Review and restrict the HTML tags allowed in your AntiSamy policy to minimize the attack surface

<!-- AntiSamy policy configuration - disable preserveComments -->
<directive name="preserveComments" value="false"/>