CVE-2020-13973
MEDIUMOWASP json-sanitizer < 1.2.1 - Cross-Site Scripting via SCRIPT Element Confusion
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-13973. PoCs published by shoucheng3, epicosy.
AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2020-13973, which involves a vulnerability in the OWASP JSON Sanitizer. The exploit demonstrates how the sanitizer can be bypassed to execute arbitrary JavaScript code, leading to potential XSS attacks.
Description
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.
Exploits (2)
This repository contains a proof-of-concept for CVE-2020-13973, which involves a vulnerability in the OWASP JSON Sanitizer. The exploit demonstrates how the sanitizer can be bypassed to execute arbitrary JavaScript code, leading to potential XSS attacks.
This repository contains documentation and release scripts for the OWASP JSON Sanitizer library, which converts JSON-like content to valid JSON. It does not include exploit code but provides context on the library's purpose and security considerations.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N