CWE-83 is a product that does not neutralize "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror or style.
It matters to any feature that lets users submit limited HTML or link attributes: rich text, web mail, guestbooks and forums.
How it happens
A filter that only strips script tags leaves the other ways to run script untouched. Event handler attributes execute script when something happens to the element. URI attributes such as href accept the javascript scheme. Style attributes were also a vector in the observed examples.
Those examples include CVE-2001-0520, which bypassed filtering of script tags using onload in the body tag and href in anchor, button and input tags. CVE-2002-1493 is guestbook XSS in style or image src attributes, CVE-2002-1965 is JavaScript in the onerror attribute of an image tag and CVE-2002-1495 is XSS in web mail via an onmouseover event. See CVE-2001-0520, CVE-2002-1493, CVE-2002-1965 and CVE-2002-1495.
A weak filter in Python:
import re
# Vulnerable: only removes script tags
clean = re.sub(r"(?i)<script.*?>.*?</script>", "", user_html)
An image tag with an onerror attribute passes straight through.
What an attacker gains
MITRE lists confidentiality, integrity and availability, through reading application data and executing unauthorized code or commands in the victim's session.
How to find it
MITRE lists automated static analysis (SAST) to model data flow. Add manual tests with each attribute type, not just script tags.
How to fix it
- Check input against an allowlist of specific characters and format. Neutralize all request data, including tag attributes, hidden fields, cookies, headers and the URL, not only fields expected to be shown.
- Escape on output for the attribute context.
- Allow known good markup only. If users may post HTML, use a vetted sanitizer that allows a short list of tags and attributes instead of removing a list of bad ones.
Quick check
Why does removing script tags not stop XSS?
Event handler attributes, javascript URIs and style attributes can run script without any script tag.
