CVE-2024-22195: Jinja vulnerable to Cross-Site Scripting (XSS)
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja xmlattr filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
Other sources
Jinja vulnerable to Cross-Site Scripting (XSS)
— Microsoft
The xmlattr filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the xmlattr filter, and an application doing so should already be verifying what keys are provided regardless of this fix.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jinja2to a version that resolves this vulnerability.Fixed in 2.10-2+deb10u1Fixed in 3.1.3-1 - Upgrade
Upgrade
ubuntu/jinja2to a version that resolves this vulnerability.Fixed in 2.10-1ubuntu0.18.04.1+ - Upgrade
Upgrade
ubuntu/jinja2to a version that resolves this vulnerability.Fixed in 2.10.1-2ubuntu0.2 - Upgrade
Upgrade
ubuntu/jinja2to a version that resolves this vulnerability.Fixed in 3.0.3-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/jinja2to a version that resolves this vulnerability.Fixed in 3.1.2-1ubuntu0.23.10.1 - Upgrade
Upgrade
ubuntu/jinja2to a version that resolves this vulnerability.Fixed in 3.1.2-1ubuntu1 - Upgrade
Upgrade
ubuntu/jinja2to a version that resolves this vulnerability.Fixed in 2.7.2-2ubuntu0.1~ - Upgrade
Upgrade
ubuntu/jinja2to a version that resolves this vulnerability.Fixed in 2.8-1ubuntu0.1+ - Upgrade
Upgrade
pip/jinja2to a version that resolves this vulnerability.Fixed in 3.1.3 - Upgrade
Upgrade
F5 Traffix Systems Signaling Delivery Controllerto a version that resolves this vulnerability.Fixed in 5.2.0 - Upgrade
Upgrade
redhat/jinja2to a version that resolves this vulnerability.Fixed in 3.1.3 - Upgrade
Upgrade
jinjato a version that resolves this vulnerability.Fixed in 3.1.3Patch GHSA-h5c8-rqwp-cp95 - Configuration
If your application uses the Jinja `xmlattr` filter with user-controlled input, ensure it does not accept user input as attribute *keys* (and prevent keys containing spaces), because the `xmlattr` filter in affected versions accepts keys with spaces and can be abused to inject arbitrary HTML attributes/values, bypassing auto escaping and potentially leading to XSS.
Jinja (xmlattr filter) Keys passed to xmlattr filter = Do not accept user-supplied attribute keys (especially keys containing spaces)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22195?
The severity of CVE-2024-22195 is categorized as high due to the potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2024-22195?
To fix CVE-2024-22195, update your Jinja2 version to at least 3.1.3 or the specific patched versions for your operating system.
What vulnerability does CVE-2024-22195 exploit?
CVE-2024-22195 exploits a flaw in the Jinja templating engine that allows the injection of arbitrary HTML attributes leading to XSS.
Which software is affected by CVE-2024-22195?
CVE-2024-22195 affects Jinja2 versions below 3.1.3 and various products including IBM QRadar SIEM and F5 Traffix SDC.
What is the potential impact of CVE-2024-22195 on web applications?
The potential impact of CVE-2024-22195 on web applications includes the ability for attackers to inject malicious scripts into web pages viewed by users.