CVE-2025-66021

Executive Summary

CVE-2025-66021 is a Cross-Site Scripting (XSS) vulnerability in the OWASP Java HTML Sanitizer, version 20240325.1. The flaw arises when HtmlPolicyBuilder is configured to allow noscript and style tags with allowTextIn enabled inside the style tag. An attacker can craft a payload that bypasses sanitization of CSS and allows tags not explicitly mentioned in the HTML policy, leading to XSS. At the time of publication, no patch is available.

Supply Chain & Package Security

This vulnerability affects the OWASP Java HTML Sanitizer library, which is commonly used as a dependency in Java web applications. Organizations using this library in their supply chain should assess their exposure and consider temporary mitigations until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): Required (likely)
• Scope (S): Changed (likely)
• Confidentiality (C): Low (likely)
• Integrity (I): Low (likely)
• Availability (A): None (likely)

Threat Level: High – XSS can lead to session hijacking, data theft, and defacement.

Deep Dive & Mechanics

The vulnerability exists in the OWASP Java HTML Sanitizer when HtmlPolicyBuilder is configured to allow noscript and style tags with allowTextIn enabled inside the style tag. The sanitizer fails to properly sanitize CSS content within these tags, allowing an attacker to inject malicious JavaScript via CSS expressions or other XSS vectors.

Root Cause: The sanitizer does not enforce a strict allowlist for CSS properties and values when allowTextIn is enabled for style tags. This allows an attacker to use CSS features like expression() (in older IE) or javascript: URLs in CSS imports to execute arbitrary JavaScript.

Attack Vector: An attacker submits a crafted HTML payload containing a style tag with malicious CSS that bypasses the sanitizer's filters. The payload is then rendered by a victim's browser, executing the XSS.

Vulnerable vs. Patched Code

Vulnerable Code (20240325.1):

// Example configuration that triggers the vulnerability
HtmlPolicyBuilder policy = new HtmlPolicyBuilder()
    .allowElements("noscript", "style")
    .allowTextIn("style")
    .toFactory();

Patched Code (Not yet available): A patch would likely involve:

• Disallowing allowTextIn for style tags when noscript is allowed.
• Implementing a strict CSS property allowlist.
• Sanitizing CSS values to remove dangerous constructs like expression(), javascript:, etc.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Set up a vulnerable Java web application using OWASP Java HTML Sanitizer 20240325.1.
2. Configure HtmlPolicyBuilder to allow noscript and style tags with allowTextIn inside style.

Exploit Payload:

<noscript><style>body { background: url('javascript:alert(1)'); }</style></noscript>

Execution:

• Submit the payload via a form or URL parameter.
• When a victim views the page, the CSS url('javascript:alert(1)') executes JavaScript in older browsers (e.g., IE).

Blue Team

Detection:

• Monitor for requests containing noscript and style tags with suspicious CSS content.
• Use WAF rules to block payloads containing javascript: in CSS URLs.

Mitigation:

• Disable allowTextIn for style tags if noscript is allowed.
• Implement a custom CSS sanitizer that strips dangerous properties.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing <noscript><style> patterns.
• Logs: Application logs showing style tags with url('javascript:...') or expression(...).
• File: Modified HTML output containing malicious CSS.

Detection Engineering

YARA Rule

rule CVE_2025_66021_XSS {
    meta:
        description = "Detects XSS payload targeting OWASP Java HTML Sanitizer"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-66021"
    strings:
        $noscript = "<noscript>" nocase
        $style = "<style" nocase
        $css_xss = /url\s*\(\s*['"]?\s*javascript:/i
        $css_expr = /expression\s*\(/i
    condition:
        $noscript and $style and ($css_xss or $css_expr)
}

Sigma Rule

title: CVE-2025-66021 XSS Payload Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests containing XSS payload for OWASP Java HTML Sanitizer
author: Valters IT
date: 2025/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET' or 'POST'
        cs-uri-query|contains:
            - '<noscript>'
            - '<style'
            - 'javascript:'
            - 'expression('
    condition: selection
falsepositives:
    - Legitimate use of CSS with javascript: in older browsers (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66021 XSS Payload"; flow:to_server,established; content:"<noscript>"; http_client_body; content:"<style"; http_client_body; pcre:"/url\s*\(\s*['""]?\s*javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

• Disable allowTextIn for style tags in HtmlPolicyBuilder configuration.
• Remove noscript from the allowed elements list if not required.
• Implement a WAF rule to block payloads containing javascript: in CSS URLs.

Long-term Fix:

• Monitor for a patch from OWASP and update to a fixed version once released.
• Consider using an alternative HTML sanitizer that properly handles CSS.

Workaround:

• Use a custom CSS sanitizer that strips dangerous properties like expression(), javascript:, and -moz-binding.

Valters IT