CVE-2017-14735 in Hyperion Infrastructure Technology
Summary
by MITRE
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/04/2025
The vulnerability identified as CVE-2017-14735 represents a critical cross-site scripting weakness in the OWASP AntiSamy library version 1.5.6 and earlier. This flaw specifically targets the library's HTML sanitization capabilities, which are designed to prevent malicious code injection in web applications. The vulnerability arises from insufficient validation of HTML5 entities within the sanitization process, allowing attackers to bypass security measures through carefully crafted input sequences.
The technical exploitation of this vulnerability leverages the fact that HTML5 introduced new entities that were not properly accounted for in the AntiSamy library's entity handling logic. The demonstration shows how an attacker can utilize the : entity to construct javascript: URLs that would otherwise be blocked by standard sanitization rules. This entity represents a colon character and when improperly handled, can be used to create malicious URLs that execute in the context of a victim's browser session. The vulnerability specifically affects the library's ability to properly escape or reject certain HTML5 entities that could be used to construct XSS payloads.
The operational impact of this vulnerability extends beyond simple script execution as it undermines the fundamental security guarantees that web applications expect from HTML sanitization libraries. When applications rely on AntiSamy for input validation, attackers can inject malicious JavaScript code that executes in users' browsers, potentially leading to session hijacking, data theft, or redirection to malicious sites. This vulnerability affects any web application that uses AntiSamy version 1.5.6 or earlier for HTML sanitization, making it particularly concerning given the library's widespread adoption in enterprise security solutions. The attack vector is particularly insidious because it can be concealed within seemingly benign HTML input, making detection and prevention challenging.
Organizations should immediately upgrade to AntiSamy version 1.5.7 or later, which includes proper handling of HTML5 entities in the sanitization process. Security teams should conduct comprehensive audits of their applications to identify any instances where AntiSamy is used and verify that all input validation is properly configured. Additionally, implementing additional security layers such as Content Security Policy headers and regular security testing can provide defense-in-depth against similar vulnerabilities. This vulnerability aligns with CWE-79, which describes cross-site scripting flaws, and maps to ATT&CK technique T1203, which covers exploitation of web application vulnerabilities. The remediation process should include thorough regression testing to ensure that the upgrade does not introduce compatibility issues while maintaining the security benefits of proper entity handling.
The broader implications of this vulnerability highlight the ongoing challenge of maintaining security in evolving web standards, particularly as HTML5 introduces new features that require careful consideration in security libraries. This case demonstrates the importance of continuous security updates and the need for thorough testing of security controls against new attack vectors. Organizations should establish robust patch management processes that include security library updates as part of their regular maintenance routines to prevent exploitation of known vulnerabilities.