| タイトル | rhukster dom-sanitizer <= 1.0.15 Improper Input Validation |
|---|
| 説明 | rhukster/dom-sanitizer is a widely used PHP HTML and SVG sanitization library designed to secure applications—including popular CMS platforms like Grav—against cross-site scripting (XSS) and malicious payload injections.
This advisory details a security bypass vulnerability affecting dom-sanitizer versions <= 1.0.15. The vulnerability is caused by an architectural asymmetry in CSS sanitization: while recent security hardening introduced robust normalization (normalizeCss() to neutralize CSS comments and hex-escape sequences) for <style> elements and inline style attributes, SVG presentation attributes that also carry CSS url() values (such as fill, stroke, filter, clip-path, mask, and marker-*) are still validated solely by a legacy, raw regex check (isExternalUrl()) without prior normalization.
Consequently, an attacker can bypass the filter by injecting CSS comments (/**/) or hex-escape sequences (\2f\2f) between url( and the malicious scheme (e.g., fill="url(\2f\2f evil.example/x)"). The browser's CSS tokenizer decodes these obfuscations into an active external reference, resulting in unintended outbound resource loading, user-agent/IP disclosure, and potential tracking or side-channel data exfiltration.
For complete technical details, including the Root Cause Analysis (RCA), vulnerable code paths, and full Steps to Reproduce (PoC), please refer to the official, publicly disclosed GitHub Security Advisory linked below |
|---|
| ソース | ⚠️ https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvc |
|---|
| ユーザー | 0xMo-Error (UID 100917) |
|---|
| 送信 | 2026年09月03日 17:27 (28 日 ago) |
|---|
| モデレーション | 2026年10月01日 11:31 (28 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 412551 [rhukster dom-sanitizer 迄 1.0.15 SVG Sanitization src/DOMSanitizer.php url 特権昇格] |
|---|
| ポイント | 20 |
|---|