Debian Rust Security Tracker 🩺🦀

RUSTSEC-2021-0158: XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

0 affected
Crate
ammonia
Patched Versions
>=4.2.3
>=4.1.7, <4.2.0
Debian Version
4.2.3-1
Debian Bugs
—
Issued
2021-10-10
Aliases
GHSA-f2pc-rwv3-69mv
Patched:Affected

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

This vulnerability was reported by ucsurf.