Cross-site Scripting Vulnerability in @braintree/sanitize-url Package
Summary
CVE-2021-23648: The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function. Affects node-mermaid across 2 version ranges.
< 8.7.0+ds+~cs27.17.17-3+deb11u1
< 34fc6435a6028a5a2a3d35b0dee2299e5a9a3580
Fixed in 8.7.0+ds+~cs27.17.17-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @braintree/sanitize-url package is a widely used library designed to sanitize URLs to prevent security issues such as XSS attacks. It is commonly integrated into web applications to ensure that user-generated content does not lead to malicious exploits. However, prior to version 6.0.0, the package had a critical vulnerability due to improper sanitization in its sanitizeUrl function, making it susceptible to XSS attacks.
Vulnerability Detail
The vulnerability arises from the sanitizeUrl function within the @braintree/sanitize-url package, which fails to adequately sanitize input URLs. This oversight allows attackers to inject malicious scripts into web applications that utilize this package, potentially leading to unauthorized access, data theft, or other harmful actions. The vulnerability is classified with a CVSS score of 6.1, indicating a moderate severity level that requires prompt attention.
How To Fix
Minimum fixed version
8.7.0+ds+~cs27.17.17-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-mermaidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a custom URL sanitization function that thoroughly checks and cleans input URLs before processing them. Below is an example of a simple workaround function:
function customSanitizeUrl(url) {
// Basic validation to check if the URL starts with http or https
if (!/^https?:///i.test(url)) {
throw new Error('Invalid URL');
}
return url;
}
Conclusion
The CVE-2021-23648 vulnerability in the @braintree/sanitize-url package poses a significant risk due to its potential for XSS attacks. Users are strongly advised to update to version 6.0.0 or later to mitigate this risk. Implementing a custom sanitization function can serve as a temporary measure until an upgrade is possible. Utilizing tools like Vulert can further enhance your security posture by providing real-time vulnerability monitoring.
See every vulnerability recorded for node-mermaid →
FAQ
The vulnerability can lead to Cross-site Scripting (XSS) attacks, allowing attackers to execute malicious scripts in the context of the user's browser.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Versions of @braintree/sanitize-url prior to 6.0.0 are vulnerable to this issue.
Yes, you can implement a custom URL sanitization function as a temporary workaround until you can upgrade the package.
Vulert is a tool that monitors open-source vulnerabilities in your software using a manifest file. It provides real-time alerts for vulnerabilities without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-mermaid.
