| 제목 | rhukster dom-sanitizer <= 1.0.15 Improper Input Validation |
|---|
| 설명 | rhukster/dom-sanitizer is a widely used PHP HTML and SVG sanitization library designed to secure applications—including popular CMS platforms like Grav—against cross-site scripting (XSS) and malicious payload injections.
This advisory details a security bypass vulnerability affecting dom-sanitizer versions <= 1.0.15. The vulnerability is caused by an architectural asymmetry in CSS sanitization: while recent security hardening introduced robust normalization (normalizeCss() to neutralize CSS comments and hex-escape sequences) for <style> elements and inline style attributes, SVG presentation attributes that also carry CSS url() values (such as fill, stroke, filter, clip-path, mask, and marker-*) are still validated solely by a legacy, raw regex check (isExternalUrl()) without prior normalization.
Consequently, an attacker can bypass the filter by injecting CSS comments (/**/) or hex-escape sequences (\2f\2f) between url( and the malicious scheme (e.g., fill="url(\2f\2f evil.example/x)"). The browser's CSS tokenizer decodes these obfuscations into an active external reference, resulting in unintended outbound resource loading, user-agent/IP disclosure, and potential tracking or side-channel data exfiltration.
For complete technical details, including the Root Cause Analysis (RCA), vulnerable code paths, and full Steps to Reproduce (PoC), please refer to the official, publicly disclosed GitHub Security Advisory linked below |
|---|
| 원천 | ⚠️ https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvc |
|---|
| 사용자 | 0xMo-Error (UID 100917) |
|---|
| 제출 | 2026. 09. 03. PM 05:27 (29 날 ago) |
|---|
| 모더레이션 | 2026. 10. 01. AM 11:31 (28 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 412551 [rhukster dom-sanitizer 까지 1.0.15 SVG Sanitization src/DOMSanitizer.php url 권한 상승] |
|---|
| 포인트들 | 20 |
|---|