Headline
CVE-2023-46267: Fix cross-site scripting (XSS) vulnerability in handling of SVG in HT… · roundcube/roundcubemail@41756cc
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows XSS via a text/html e-mail message containing an SVG image with a USE element. This is related to wash_uri in rcube_washtml.php.
Expand Up @@ -455,6 +455,24 @@ function data_wash_svg_tests() '<svg><script href="data:text/javascript,alert(1)" /><text x="20" y="20">XSS</text></svg>’, ‘<svg><text x="20" y="20">XSS</text></svg>’ ], [ ‘<html><svg><use href="data:image/s vg+xml;base64,’ // space . ‘PHN2ZyBpZD0ieCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4gPGltYWdlIGhy’ . 'ZWY9IngiIG9uZXJyb3I9ImFsZXJ0KCcxJykiLz48L3N2Zz4=#x"></svg></html>’, ‘<svg><use x-washed="href"></use></svg>’ ], [ ‘<html><svg><use href="data:image/s’ . “\n” . ‘vg+xml;base64,’ // new-line . ‘PHN2ZyBpZD0ieCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4gPGltYWdlIGhy’ . 'ZWY9IngiIG9uZXJyb3I9ImFsZXJ0KCcxJykiLz48L3N2Zz4=#x"></svg></html>’, ‘<svg><use x-washed="href"></use></svg>’ ], [ ‘<html><svg><use href="data:image/s vg+xml;base64,’ // tab . ‘PHN2ZyBpZD0ieCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4gPGltYWdlIGhy’ . 'ZWY9IngiIG9uZXJyb3I9ImFsZXJ0KCcxJykiLz48L3N2Zz4=#x"></svg></html>’, ‘<svg><use x-washed="href"></use></svg>’ ], ]; }
Expand Down