- What is CWE-83?
- The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
- What CVEs are caused by CWE-83?
- 20 recorded CVEs are attributed to CWE-83, including CVE-2023-37908, CVE-2023-32070, CVE-2026-23516.
- How do you prevent CWE-83?
- Carefully check each input parameter against a rigorous positive specification (allowlist) defining the specific characters and format allowed. All input should be neutralized, not just parameters that the user is supposed to specify, but all data in the request, including tag attributes, hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS vulnerabilities is to validate only fields that are expected to be redisplayed by the site. We often encounter data from the request that is reflected by the application server or the application that the development team did not anticipate. Also, a field that is not currently reflected may be used by a future developer. Therefore, validating ALL parts of the HTTP request is recommended.
- How is CWE-83 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-83?
- Exploiting CWE-83 can lead to: Read Application Data, Execute Unauthorized Code or Commands.
- Is CWE-83 actively exploited?
- 20 recorded CVEs are caused by CWE-83; none are currently in CISA's KEV catalog of actively exploited flaws.
