Affected: Homebrew: gptline
### Summary The `<base>` tag passes through the default `Cleaner` configuration. While `page_structure=True` removes `html`, `head`, and `title` tags, there is no specific handling for `<base>`, allowing an attacker to inject it and hijack relative links on the page.
### Details The `<base>` tag is not currently in the `page_structure` kill set. Even though the specification says `<base>` must be inside `<head>`, browsers accept `<base>` tags outside of the head.
If an attacker injects a `<base>` tag, it changes the base URL for all relative URLs on the page (links, images, scripts) to a domain controlled by the attacker.
### PoC ```python from lxml_html_clean import clean_html
# The base tag is preserved in the output result = clean_html('<base href="http://evil.com/"><a href="/account">Account</a>') print(result) # Output: <div><base href="http://evil.com/">...<a href="/account">Account</a></div> ```
### Impact The injection of a `<base>` tag allows an attacker to hijack the resolution of **all** relative URLs on the page. This results in three critical attack vectors:
1. **Phishing & Redirection:** Attackers can redirect user navigation (e.g., `<a href="/login">`) and form submissions (e.g., `<form action="/auth">`) to an attacker-controlled domain, effectively stealing credentials or sensitive data without the user realizing they have left the legitimate site. 2. **Cross-Site Scripting (XSS):** If the victim application loads JavaScript files using relative paths…
Affected: fedora-python lxml_html_clean
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for <base>, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.
Affected: PyPI: lxml-html-clean
### Summary The `<base>` tag passes through the default `Cleaner` configuration. While `page_structure=True` removes `html`, `head`, and `title` tags, there is no specific handling for `<base>`, allowing an attacker to inject it and hijack relative links on the page.
### Details The `<base>` tag is not currently in the `page_structure` kill set. Even though the specification says `<base>` must be inside `<head>`, browsers accept `<base>` tags outside of the head.
If an attacker injects a `<base>` tag, it changes the base URL for all relative URLs on the page (links, images, scripts) to a domain controlled by the attacker.
### PoC ```python from lxml_html_clean import clean_html
# The base tag is preserved in the output result = clean_html('<base href="http://evil.com/"><a href="/account">Account</a>') print(result) # Output: <div><base href="http://evil.com/">...<a href="/account">Account</a></div> ```
### Impact The injection of a `<base>` tag allows an attacker to hijack the resolution of **all** relative URLs on the page. This results in three critical attack vectors:
1. **Phishing & Redirection:** Attackers can redirect user navigation (e.g., `<a href="/login">`) and form submissions (e.g., `<form action="/auth">`) to an attacker-controlled domain, effectively stealing credentials or sensitive data without the user realizing they have left the legitimate site. 2. **Cross-Site Scripting (XSS):** If the victim application loads JavaScript files using relative paths…