jsoup up to 1.15.2 javascript URL cross site scripting

Summaryinfo

A vulnerability has been found in jsoup up to 1.15.2 and classified as problematic. The impacted element is an unknown function of the component javascript URL Handler. This manipulation causes cross site scripting. This vulnerability is handled as CVE-2022-36033. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in jsoup up to 1.15.2. It has been declared as problematic. Affected by this vulnerability is an unknown part of the component javascript URL Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)

The weakness was released 08/29/2022 as GHSA-gp7f-rwcx-9369. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2022-36033 since 07/15/2022. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 209012 (RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.19 Security update (Important) (RHSA-2024:8077)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.15.3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (209012). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• jsoup

Version

• 1.15.0
• 1.15.1
• 1.15.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion