Skip to content
Fencer Intel
no cvss —

GHSA-f2pc-rwv3-69mv json

XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

published 5y ago modified 30d ago also RUSTSEC-2021-0158

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The neutralization that ammonia applied to `animate` and `set` was not applied to other forms of SVG animation, which can be used for XSS.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

```xml <svg xmlns="http://www.w3.org/2000/svg"> <a> <animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion> <text y="30">Click set</text> </a> </svg> ```

Ammonia did not apply attribute filters based on `attributeName`, so the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

---

This vulnerability was reported by [ucsurf](https://uc.surf).

Patch / fix

  • crates.io ammonia 4.1.7, 4.2.3

Is GHSA-f2pc-rwv3-69mv in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io ammonia
>=0.0.0-0, <4.1.7
>=4.2.0, <4.2.3
4.1.7
4.2.3

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.