Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-23499

CVE-2022-23499: TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-23499
GHSA ID
GHSA-hvwx-qh2h-xcfj
EPSS Score
0.07963%
CWE
CWE-79
Published
12/13/2022
Updated
1/29/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
typo3/html-sanitizercomposer>= 1.0.0, < 1.5.01.5.0
typo3/html-sanitizercomposer>= 2.0.0, < 2.1.12.1.1
typo3/cmscomposer>= 10.0.0, < 10.4.3310.4.33
typo3/cmscomposer>= 11.0.0, < 11.5.2011.5.20
typo3/cmscomposer>= 12.0.0, < 12.1.112.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key issues: 1) Improper handling of CDATA sections parsed as DOMText nodes by masterminds/html5, and 2) Lack of processing for raw text elements returned as DOMText. The CommonVisitor's text node handling (visitText) was vulnerable because it didn't escape CDATA content or process raw text elements. The CommonBuilder's configuration gap (createBehavior) left these elements unregulated. The security patches explicitly modified these components to add CDATA escaping and raw text element processing, confirming their role in the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Pro*l*m *u* to * p*rsin* issu* in t** upstr**m p**k*** [`m*st*rmin*s/*tml*`](*ttps://p**k**ist.or*/p**k***s/m*st*rmin*s/*tml*), m*li*ious m*rkup us** in * s*qu*n** wit* sp**i*l *TML ***T* s**tions **nnot ** *ilt*r** *n* s*nitiz**. T*is *llows *yp

Reasoning

T** vuln*r**ility st*ms *rom two k*y issu*s: *) Improp*r **n*lin* o* ***T* s**tions p*rs** *s `*OMT*xt` no**s *y `m*st*rmin*s/*tml*`, *n* *) L**k o* pro**ssin* *or r*w t*xt *l*m*nts r*turn** *s `*OMT*xt`. T** `*ommonVisitor`'s t*xt no** **n*lin* (`vi