Symfony HtmlSanitizer URL Attribute Sanitization Vulnerability in Meta Refresh and Embedding Elements

A vulnerability exists in the Symfony framework's HTML sanitizer component, specifically in the URL attribute sanitizer for certain HTML elements. In versions 6.1.0 prior to 6.4.41, 7.4.13, and 8.0.13, the sanitizer failed to properly handle URL-bearing attributes on <object>, <applet>, <iframe>, <img>, and <meta http-equiv="refresh"> elements. This oversight allowed URLs containing JavaScript payloads to bypass sanitization and be injected into the output, potentially leading to cross-site scripting (XSS) attacks. The issue arises when integrators explicitly allow these elements and attributes, enabling the injection of malicious URLs that are not properly sanitized.

Impact

Allowing URL attributes to be injected without proper sanitization can lead to cross-site scripting (XSS) vulnerabilities, where an attacker can execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a Symfony application that uses the HtmlSanitizer component. Allow the <object>, <applet>, <iframe>, or <meta> elements with the corresponding URL-bearing attributes through the sanitizer configuration. Then, inject a URL with a JavaScript payload, such as 'javascript:alert(1)', into the allowed attribute. The payload will be executed when the sanitized output is rendered.

Remediation

Users can update to Symfony versions 6.4.41, 7.4.13, or 8.0.13, where this vulnerability has been fixed. Instructions for updating can be found in the Symfony release notes.