Stored XSS in Ammonia HTML Sanitizer

Executive Summary

This vulnerability affects the ammonia Rust library, which is used to sanitize and secure untrusted HTML. Versions prior to 3.3.3, 4.0.3, and 4.1.4 allow SVG elements with animation or set elements targeting href attributes using javascript: scheme. This can create a script-bearing link that executes attacker-controlled script when clicked, leading to stored cross-site scripting (XSS).

Useful 0 Not Useful 0

Detection Guidance

Check the version of ammonia in your project dependencies. If using Cargo, run cargo tree -p ammonia to verify if the version is below 3.3.3, 4.0.3, or 4.1.4. Inspect SVG inputs for animate or set elements targeting href with javascript: values.

Useful 0 Not Useful 0

Impact Analysis

If you use an affected version of ammonia in your application, attackers could inject malicious scripts via SVG animations. When users interact with these sanitized but malicious SVGs, the scripts execute in your application's context, potentially stealing user data, session tokens, or performing unauthorized actions on behalf of users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ammonia to version 3.3.3, 4.0.3, or 4.1.4 or later. Review and sanitize SVG inputs to remove or neutralize animate or set elements with javascript: in href attributes. Apply input validation and output encoding in your application.

Useful 0 Not Useful 0