Information Exposure Vulnerability in node-sanitize-html Package
Summary
CVE-2024-21501: Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dep... Affects node-sanitize-html versions < c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-sanitize-html package is a popular library used in Node.js applications to sanitize HTML content, ensuring that it is safe for rendering in web applications. It allows developers to specify which HTML elements and attributes are permitted, helping to prevent cross-site scripting (XSS) attacks. However, certain configurations, particularly when allowing the style attribute, can expose sensitive information about the server's file system structure, making it vulnerable to exploitation.
Vulnerability Detail
The vulnerability, identified as CVE-2024-21501, affects versions of the node-sanitize-html package prior to 2.12.1. When used on the backend with the style attribute allowed, it can lead to information exposure, allowing attackers to enumerate files within the system, including project dependencies. This could enable an attacker to gather critical details about the server's file system, potentially leading to further attacks or data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the use of the style attribute in your sanitization configuration. This can be done by modifying the options passed to the sanitize-html function. For example:
const sanitizeHtml = require('sanitize-html');
const cleanHtml = sanitizeHtml(dirtyHtml, {
allowedAttributes: {}, // Disallow all attributes
allowedTags: ['b', 'i', 'em', 'strong', 'a'], // Specify allowed tags
});
Conclusion
The node-sanitize-html package has a critical vulnerability that can lead to information exposure if not addressed. It is essential for developers using this package to update to the latest version to protect their applications from potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-sanitize-html →
FAQ
CVE-2024-21501 is a vulnerability in the node-sanitize-html package that allows information exposure when the style attribute is permitted.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is that an attacker could enumerate files on the server, potentially leading to further exploitation or data breaches.
You can update the package by running the command 'npm install sanitize-html@latest' in your terminal.
Yes, you can temporarily disable the style attribute in your sanitization options as a workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-sanitize-html.
