CVE-2022-36033 in FLEXCUBE Enterprise Limits and Collateral Management
Summary
by MITRE • 08/29/2022
jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/20/2025
The jsoup library vulnerability CVE-2022-36033 represents a critical cross-site scripting security flaw that affects developers using this popular Java HTML parsing and sanitization tool. This vulnerability specifically targets the library's HTML sanitization capabilities, which are designed to prevent malicious HTML content from being executed in web applications. The flaw occurs when the library incorrectly handles javascript: URL expressions during HTML sanitization, creating potential attack vectors for XSS exploits. The vulnerability is particularly concerning because jsoup is widely used for HTML editing, cleaning, scraping, and XSS safety protection, making it a common component in web application security implementations.
The technical flaw manifests when the SafeList.preserveRelativeLinks option is enabled, which is not the default setting but can be configured by developers. Under this configuration, crafted HTML containing javascript: URLs with control characters bypasses the sanitization process entirely. This allows attackers to inject malicious JavaScript code that executes when users click on the affected links. The vulnerability is classified as a CWE-79: Improper Neutralization of Input During Web Page Generation, which specifically addresses the failure to properly sanitize user input that gets rendered in web pages. The flaw demonstrates a classic input validation and sanitization weakness where the library fails to properly handle special characters in URL schemes, allowing attackers to craft malicious content that appears legitimate but contains executable JavaScript code.
The operational impact of this vulnerability extends beyond simple XSS attacks, as it can lead to complete session hijacking, data theft, and further exploitation of web applications. When combined with the absence of proper Content Security Policy (CSP) headers, the vulnerability becomes even more dangerous because there are no additional layers of protection to prevent the execution of malicious scripts. This creates a scenario where attackers can exploit the vulnerability to steal cookies, perform unauthorized actions on behalf of users, or redirect users to malicious sites. The attack surface is particularly broad given that jsoup is used across numerous web applications for HTML processing, making this vulnerability potentially widespread. The issue follows ATT&CK technique T1059.007: Command and Scripting Interpreter: JavaScript, as it enables attackers to execute JavaScript code through improperly sanitized HTML content.
The remediation approach requires immediate action from affected organizations, with the primary solution being the upgrade to jsoup version 1.15.3, which contains the necessary patches to address the sanitization flaw. However, organizations should also conduct a thorough review of previously processed content, as the vulnerability allows for persisted malicious content that could already be present in databases or storage systems. For those unable to upgrade immediately, two mitigation strategies are recommended: disabling the SafeList.preserveRelativeLinks option to force URL rewriting to absolute format, and implementing proper Content Security Policy headers as a defense-in-depth measure. The Content Security Policy implementation addresses the same CWE-79 category by providing additional protection layers that prevent execution of unauthorized scripts even if the primary sanitization fails. Organizations should also consider implementing additional security controls such as input validation, output encoding, and regular security audits to prevent similar vulnerabilities in their applications. This vulnerability underscores the critical importance of proper HTML sanitization in web applications and demonstrates how seemingly minor configuration options can create significant security risks when not properly validated.