CVE-2024-23635

Executive Summary

CVE-2024-23635 is a mutation Cross-Site Scripting (mXSS) vulnerability in the OWASP AntiSamy library, versions prior to 1.7.5. The flaw arises from flawed HTML parsing when the preserveComments directive is enabled in the policy file. An attacker can craft input that, when sanitized by AntiSamy, results in HTML comment tags being misinterpreted as executable code, leading to XSS. The CVSS score is 6.1 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation. No public exploit code or Nuclei template is available. The patch is available in AntiSamy 1.7.5.

Supply Chain & Package Security

AntiSamy is a Java library distributed via Maven Central. Organizations using AntiSamy in their Java web applications should immediately update to version 1.7.5 or later. The vulnerability is introduced through the library's dependency chain, and any application using a vulnerable version with preserveComments enabled is at risk. Verify the library version in your pom.xml or build.gradle file.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must view sanitized output
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for preserveComments to be enabled and the need for user interaction reduce the risk, but successful exploitation can lead to XSS attacks.

Deep Dive & Mechanics

The vulnerability is a mutation XSS (mXSS) that exploits the way AntiSamy parses HTML comments when preserveComments is enabled. Normally, HTML comments (<!-- ... -->) are stripped or preserved as inert text. However, due to a parsing flaw, certain crafted inputs can cause the sanitizer to misinterpret comment boundaries, allowing elements inside comments to be treated as active HTML after sanitization.

Root Cause: The HTML parser in AntiSamy does not correctly handle nested or malformed comment structures when preserveComments is active. This allows an attacker to inject a payload that, after sanitization, becomes executable JavaScript.

Attack Vector: An attacker submits crafted HTML to an application that uses AntiSamy for sanitization. The application then outputs the sanitized HTML to a victim's browser, where the mXSS payload executes.

Prerequisites:

• AntiSamy version < 1.7.5
• preserveComments directive enabled in the policy file
• User interaction (victim views the sanitized output)

Vulnerable vs. Patched Code

Vulnerable Code (AntiSamy < 1.7.5):

// Policy file with preserveComments enabled
<anti-samy>
    <directives>
        <directive name="preserveComments" value="true"/>
    </directives>
</anti-samy>

Patched Code (AntiSamy 1.7.5+):

// The parser now correctly handles comment boundaries
// No specific code change visible; the fix is in the HTML parsing logic

Explanation: The patch modifies the HTML parser to properly handle comment tokens, preventing mutation XSS. The exact code changes are internal to the library.

Exploitation & Lab Setup

Red Team

Proof of Concept (No public exploit available):

<!--[if !IE]><!--><script>alert('XSS')</script><!--<![endif]-->

When processed by vulnerable AntiSamy with preserveComments enabled, the comment may be stripped, but the <script> tag inside could be misinterpreted as active content.

Lab Setup:

1. Use a Java web application with AntiSamy 1.7.4.
2. Enable preserveComments in the policy file.
3. Submit the crafted payload via a form or API.
4. Observe the sanitized output in a browser.

Blue Team

Detection:

• Monitor for unusual HTML comment structures in user input.
• Check for preserveComments being enabled in AntiSamy policy files.
• Review web application logs for XSS-related alerts.

Mitigation:

• Upgrade to AntiSamy 1.7.5 or later.
• Disable preserveComments if not required.
• Implement Content Security Policy (CSP) headers.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing nested HTML comments with script tags.
• File: AntiSamy policy files with <directive name="preserveComments" value="true"/>.
• Logs: Application logs showing sanitized output with unexpected script execution.

Detection Engineering

YARA Rule

rule CVE_2024_23635_AntiSamy_mXSS {
    meta:
        description = "Detects AntiSamy policy files with preserveComments enabled"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23635"
    strings:
        $policy = "preserveComments" nocase
        $value = "true" nocase
    condition:
        $policy and $value
}

Sigma Rule

title: AntiSamy mXSS Vulnerability - preserveComments Enabled
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects AntiSamy policy files with preserveComments enabled, indicating potential CVE-2024-23635 exploitation.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23635
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 'antisamy'
        TargetFilename|endswith: '.xml'
        Details|contains: 'preserveComments'
    condition: selection
falsepositives:
    - Legitimate use of preserveComments
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23635 AntiSamy mXSS Attempt"; flow:to_server; content:"<!--"; content:"<script"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade AntiSamy to version 1.7.5 or later.
• Disable preserveComments in the policy file if not required.

Long-term:

• Implement Content Security Policy (CSP) headers.
• Regularly update dependencies.
• Conduct security reviews of HTML sanitization logic.

Patch Details: Upgrade to AntiSamy 1.7.5 from Maven Central.

Valters IT