| عنوان | rhukster dom-sanitizer <= 1.0.15 Improper Input Validation |
|---|
| الوصف | rhukster/dom-sanitizer is a widely used PHP HTML and SVG sanitization library designed to secure applications—including popular CMS platforms like Grav—against cross-site scripting (XSS) and malicious payload injections.
This advisory details a security bypass vulnerability affecting dom-sanitizer versions <= 1.0.15. The vulnerability is caused by an architectural asymmetry in CSS sanitization: while recent security hardening introduced robust normalization (normalizeCss() to neutralize CSS comments and hex-escape sequences) for <style> elements and inline style attributes, SVG presentation attributes that also carry CSS url() values (such as fill, stroke, filter, clip-path, mask, and marker-*) are still validated solely by a legacy, raw regex check (isExternalUrl()) without prior normalization.
Consequently, an attacker can bypass the filter by injecting CSS comments (/**/) or hex-escape sequences (\2f\2f) between url( and the malicious scheme (e.g., fill="url(\2f\2f evil.example/x)"). The browser's CSS tokenizer decodes these obfuscations into an active external reference, resulting in unintended outbound resource loading, user-agent/IP disclosure, and potential tracking or side-channel data exfiltration.
For complete technical details, including the Root Cause Analysis (RCA), vulnerable code paths, and full Steps to Reproduce (PoC), please refer to the official, publicly disclosed GitHub Security Advisory linked below |
|---|
| المصدر | ⚠️ https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvc |
|---|
| المستخدم | 0xMo-Error (UID 100917) |
|---|
| ارسال | 03/09/2026 05:27 PM (28 أيام منذ) |
|---|
| الاعتدال | 01/10/2026 11:31 AM (28 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 412551 [rhukster dom-sanitizer حتى 1.0.15 SVG Sanitization src/DOMSanitizer.php url تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|