Critical ReDoS Vulnerability in libhtml-stripscripts-perl Package
Summary
DEBIAN-CVE-2023-24038: The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attributes. Affects libhtml-stripscripts-perl versions < 1.06-1+deb11u1. Fixed in 1.06-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libhtml-stripscripts-perl is a Perl module designed to strip scripts from HTML content, ensuring that potentially harmful scripts do not execute in web applications. This package is widely used in various Debian-based systems to enhance security by sanitizing user input. However, it is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking when processing certain HTML content with specific style attributes.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-24038 affects the HTML-StripScripts module through version 1.06. It allows an attacker to exploit the _hss_attval_style function, leading to a ReDoS condition. This occurs when the module processes HTML content containing certain style attributes, causing the regex engine to enter a catastrophic backtracking scenario. The implications of this vulnerability include potential service downtime and degraded performance, as the application may become unresponsive under attack.
How To Fix
Minimum fixed version
1.06-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libhtml-stripscripts-perlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user input before passing it to the libhtml-stripscripts-perl module, ensuring that any potentially harmful style attributes are removed or encoded. This can be done using a simple regex replacement in your application code, such as: input_string =~ s/style="[^"]*"//g;
Conclusion
The libhtml-stripscripts-perl package has a critical vulnerability that can lead to ReDoS attacks, affecting the performance and availability of applications that utilize it. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, implementing input sanitization can serve as a temporary measure until the update is applied.
See every vulnerability recorded for libhtml-stripscripts-perl →
FAQ
A ReDoS (Regular Expression Denial of Service) attack exploits the way regular expressions are processed, causing the application to consume excessive resources and potentially crash.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to analyze your manifest file for vulnerabilities without requiring any signup.
The consequences include potential downtime, degraded performance, and increased resource consumption, which can lead to denial of service for legitimate users.
Yes, you can implement input sanitization as a temporary workaround to prevent the exploitation of this vulnerability until you can apply the necessary updates.
You can find more information about the libhtml-stripscripts-perl package in the official Debian package repository or its documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libhtml-stripscripts-perl.
