CVE-2023-51652

Executive Summary

CVE-2023-51652 is a Mutation Cross-Site Scripting (mXSS) vulnerability in the OWASP AntiSamy .NET library, a tool designed to sanitize untrusted HTML input. The flaw arises from incorrect parsing of HTML comments when the preserveComments directive is enabled in the policy file. An attacker can craft input that, after sanitization, causes elements inside comment tags to be interpreted as executable code by the browser, bypassing the intended security controls. The vulnerability has a CVSS score of 6.1 (Medium) and affects versions prior to 1.2.0. The official fix is to upgrade to version 1.2.0 or later, or to disable preserveComments and remove the noscript tag as a workaround.

Supply Chain & Package Security

This vulnerability affects the OWASP AntiSamy .NET library, which is distributed via NuGet. Organizations using this library in their .NET applications are at risk. The supply chain risk is moderate, as the library is widely used for HTML sanitization in web applications. The patch is available in version 1.2.0, and users should update their package references immediately. There is no evidence of malicious packages or typosquatting related to this CVE at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must visit a crafted page or view sanitized output.
• Scope (S): Changed (C) – The impact can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction and specific configuration (preserveComments enabled) to be exploitable. However, if conditions are met, it can lead to XSS attacks, potentially allowing session hijacking, defacement, or data theft.

Deep Dive & Mechanics

The vulnerability is a Mutation XSS (mXSS) that exploits the way AntiSamy .NET (via its dependency HtmlAgilityPack) parses HTML comments. When preserveComments is enabled, the sanitizer retains HTML comments. An attacker can inject a comment that contains HTML tags (e.g., <img src=x onerror=alert(1)>). Due to a parsing flaw, the sanitizer may not properly escape or remove these tags, and the browser may interpret them as active content after the sanitized output is rendered.

The core issue is that the parser (HtmlAgilityPack) and the sanitizer do not agree on the interpretation of the HTML. The parser sees the content inside a comment as a comment, but the browser may treat it differently under certain conditions (e.g., when the comment is inside a <noscript> tag or when the HTML is re-parsed by the browser). This discrepancy allows the attacker to bypass the sanitizer.

Attack Scenario:

1. The victim's application uses AntiSamy .NET with preserveComments enabled.
2. The attacker submits a crafted input containing a comment with malicious HTML, e.g., <!-- <img src=x onerror=alert(1)> -->.
3. AntiSamy sanitizes the input but, due to the bug, does not neutralize the tags inside the comment.
4. The sanitized output is rendered in the victim's browser. The browser interprets the comment content as HTML, executing the malicious script.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.2.0): The vulnerable code does not properly handle HTML comments when preserveComments is enabled. The comment content is passed through without proper escaping or removal of dangerous tags.

// Vulnerable: Comments are preserved but not sanitized
if (preserveComments && node.NodeType == HtmlNodeType.Comment)
{
    output.Append(node.OuterHtml);
}

Patched Code (1.2.0): The patched version ensures that comment content is either removed or properly escaped to prevent XSS. The fix likely involves stripping or encoding HTML tags inside comments.

// Patched: Comments are sanitized or removed
if (preserveComments && node.NodeType == HtmlNodeType.Comment)
{
    // Sanitize comment content to remove dangerous tags
    string safeComment = SanitizeCommentContent(node.InnerHtml);
    output.Append($"<!-- {safeComment} -->");
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target application using AntiSamy .NET < 1.2.0 with preserveComments enabled.
• Ability to submit HTML content that will be sanitized and displayed to other users.

Exploit Payload:

<!-- <img src=x onerror=alert('XSS')> -->

Steps:

1. Identify an input field that uses AntiSamy for sanitization.
2. Submit the payload above.
3. When another user views the sanitized output, the script executes.

Advanced Payload (if <noscript> is allowed):

<noscript><!-- <img src=x onerror=alert('XSS')> --></noscript>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual HTML comments in user input, especially those containing HTML tags.
• Look for patterns like <!-- < or <!-- <img in logs.
• Use WAF rules to block comments with active content.

Hardening:

• Upgrade to AntiSamy .NET 1.2.0 or later.
• If upgrade is not possible, disable preserveComments in the policy file.
• Remove or block the <noscript> tag in the policy.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing <!-- <img or <!-- <script patterns.
  • Requests with preserveComments=true in policy parameters (if exposed).

• File IOCs:

  • AntiSamy policy files (e.g., antisamy.xml) with preserveComments set to true.
  • Log entries showing sanitized output with unescaped HTML tags inside comments.

• Behavioral IOCs:

  • Unexpected JavaScript execution in the context of the application.
  • Alerts from XSS detection tools.

Detection Engineering

YARA Rule

rule CVE_2023_51652_AntiSamy_mXSS {
    meta:
        description = "Detects potential mXSS payloads targeting CVE-2023-51652 in OWASP AntiSamy .NET"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-51652"
    strings:
        $comment_tag = /<!--\s*<[a-zA-Z]/ 
        $noscript_tag = /<noscript>/
        $dangerous_tag = /<img\s+[^>]*onerror/i
        $script_tag = /<script[^>]*>/
    condition:
        ($comment_tag and ($dangerous_tag or $script_tag)) or
        ($noscript_tag and $comment_tag)
}

Sigma Rule

title: CVE-2023-51652 - AntiSamy mXSS Payload Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests containing potential mXSS payloads targeting OWASP AntiSamy .NET
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '<!-- <img'
            - '<!-- <script'
            - '<!-- <svg'
    condition: selection
falsepositives:
    - Legitimate use of HTML comments with code examples
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-51652 - AntiSamy mXSS Payload"; flow:to_server,established; content:"<!-- <img"; nocase; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update to OWASP AntiSamy .NET version 1.2.0 or later.
2. Workaround: If upgrade is not possible, edit the policy file (e.g., antisamy.xml) to set preserveComments to false and remove the <noscript> tag from allowed tags.

Long-term Measures:

• Implement a Content Security Policy (CSP) to reduce the impact of XSS.
• Regularly update dependencies and monitor for security advisories.
• Conduct code reviews to ensure proper use of sanitization libraries.
• Use automated scanning tools to detect vulnerable versions in your codebase.

Patch Details:

• Fixed Version: 1.2.0
• Patch Source: NuGet package update or GitHub release.
• Commit/Release: Refer to the official OWASP AntiSamy .NET repository.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert