CVE-2025-66021
📋 TL;DR
This vulnerability in OWASP Java HTML Sanitizer allows cross-site scripting (XSS) attacks when the HtmlPolicyBuilder configuration permits noscript and style tags with allowTextIn inside style tags. Attackers can bypass sanitization by crafting malicious CSS payloads. This affects web applications using the vulnerable sanitizer version to process third-party HTML content.
💻 Affected Systems
- OWASP Java HTML Sanitizer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, credentials, or performing actions on behalf of authenticated users.
Likely Case
Targeted XSS attacks leading to session hijacking, credential theft, or defacement of web applications.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy headers in place.
🎯 Exploit Status
Exploitation requires specific policy configurations and crafted CSS payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-g9gq-3pfx-2gw2
Restart Required: Yes
Instructions:
No official patch available. Monitor the GitHub advisory for updates and apply when released.
🔧 Temporary Workarounds
Update HtmlPolicyBuilder Configuration
allModify sanitizer configuration to disallow noscript and style tags or restrict allowTextIn usage within style tags.
Review and update Java code using HtmlPolicyBuilder to remove vulnerable configurations
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to mitigate XSS impact
- Apply additional input validation and output encoding layers
🔍 How to Verify
Check if Vulnerable:
Check if using OWASP Java HTML Sanitizer version 20240325.1 with HtmlPolicyBuilder allowing noscript and style tags with allowTextIn inside style tags.Check Version:
Check Maven/Gradle dependencies or project configuration for 'owasp-java-html-sanitizer' version.Verify Fix Applied:
Verify configuration changes by testing with XSS payloads and reviewing sanitizer output.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML/CSS patterns in user input logs
- Sanitizer error or warning messages
Network Indicators:
- Suspicious JavaScript execution patterns in browser traffic
SIEM Query:
Search for patterns of noscript/style tags in user-submitted HTML content