CVE-2022-48345: Cross-site Scripting vulnerability in @braintree/sanitize-url
Summary
CVE-2022-48345: @braintree/sanitize-url Cross-site Scripting vulnerability. Affects @braintree/sanitize-url versions < 6.0.1. Fixed in 6.0.1. How to fix ↓
Also tracked for
- node-mermaid · Debian:11
The same CVE-2022-48345 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @braintree/sanitize-url package is an npm package that provides a function for sanitizing URLs. It is commonly used in web applications to prevent cross-site scripting (XSS) attacks by removing potentially malicious code from user-supplied URLs. However, versions before 6.0.1 of this package are vulnerable to a cross-site scripting vulnerability.
Vulnerability Detail
The vulnerability in @braintree/sanitize-url (aka @braintree/sanitize-url) before version 6.0.1 allows for cross-site scripting (XSS) attacks via HTML entities. This means that an attacker can inject malicious code into a URL, which will then be executed by a user's browser when they visit the manipulated URL. This can lead to various security issues, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user.
How To Fix
Minimum fixed version
6.0.1
This is the first release that contains the fix.
npm install @braintree/sanitize-url@6.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually sanitize the URLs using a trusted library or function. Here's an example of how you can sanitize a URL using the DOMPurify library:
const DOMPurify = require('dompurify');
const sanitizedUrl = DOMPurify.sanitize(url);
Conclusion
In conclusion, the @braintree/sanitize-url package before version 6.0.1 is vulnerable to a cross-site scripting (XSS) attack. It is crucial to upgrade to the latest version or apply the provided workaround to mitigate the risk of exploitation. Regularly monitoring for vulnerabilities using tools like Vulert can help ensure the security of your applications.
See every vulnerability recorded for @braintree/sanitize-url →
FAQ
This vulnerability allows an attacker to inject and execute malicious code in a user's browser, potentially leading to various security issues such as data theft or unauthorized actions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 6.1. CVSS (Common Vulnerability Scoring System) is a standardized system for assessing the severity of vulnerabilities.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the vulnerability promptly to prevent potential attacks.
For further support on vulnerability remediation or any other security concerns, you can reach out to info@devnack.com. Our team of experts will be happy to assist you.
Related vulnerabilities
Recent vulnerabilities recorded for @braintree/sanitize-url.
