CVE-2021-42575
📋 TL;DR
CVE-2021-42575 is a critical vulnerability in the OWASP Java HTML Sanitizer that allows bypassing HTML sanitization policies for SELECT, STYLE, and OPTION elements. This enables cross-site scripting (XSS) attacks where malicious scripts can execute in users' browsers. Any Java application using vulnerable versions of this library for HTML sanitization is affected.
💻 Affected Systems
- OWASP Java HTML Sanitizer
- Any Java application using OWASP Java HTML Sanitizer
📦 What is this software?
Middleware Common Libraries And Tools by Oracle
View all CVEs affecting Middleware Common Libraries And Tools →
⚠️ Risk & Real-World Impact
Worst Case
Attackers can execute arbitrary JavaScript in victims' browsers, leading to session hijacking, credential theft, complete account takeover, and client-side attacks against application users.
Likely Case
Cross-site scripting attacks that steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users.
If Mitigated
With proper Content Security Policy headers and other defense-in-depth controls, impact is reduced to limited script execution within CSP constraints.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious page) but is straightforward for attackers with XSS knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20211018.1 or later
Vendor Advisory: https://github.com/OWASP/java-html-sanitizer/releases/tag/v20211018.1
Restart Required: Yes
Instructions:
1. Update Maven/Gradle dependency to version 20211018.1 or later. 2. Rebuild and redeploy application. 3. Restart application servers.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd strict Content Security Policy headers to limit script execution sources
Content-Security-Policy: default-src 'self'; script-src 'self'
Input Validation Enhancement
allAdd additional input validation before HTML sanitization
🧯 If You Can't Patch
- Implement WAF rules to block malicious HTML/JavaScript patterns
- Isolate vulnerable applications behind reverse proxies with additional sanitization
🔍 How to Verify
Check if Vulnerable:
Check Maven pom.xml or Gradle build.gradle for OWASP Java HTML Sanitizer version < 20211018.1Check Version:
grep -r "java-html-sanitizer" pom.xml build.gradleVerify Fix Applied:
Verify library version is 20211018.1 or later in dependency files and deployed application📡 Detection & Monitoring
Log Indicators:
- Unusual HTML patterns with SELECT/STYLE/OPTION elements in user input
- XSS attack patterns in web server logs
Network Indicators:
- Malicious script injection attempts in HTTP requests
- Unexpected external script loads
SIEM Query:
source="web_server" AND ("SELECT" OR "STYLE" OR "OPTION") AND ("script" OR "javascript" OR "onload")🔗 References
- https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
