Information Exposure Vulnerability in node-sanitize-html Package
Summary
DEBIAN-CVE-2024-21501: Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dep... Affects node-sanitize-html versions < 2.13.0+~2.11.0-1. Fixed in 2.13.0+~2.11.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-sanitize-html package is a popular library used in Node.js applications to sanitize HTML content, ensuring that it is safe for rendering in web applications. It allows developers to specify which HTML tags and attributes are permitted, making it a crucial tool for preventing XSS (Cross-Site Scripting) attacks. However, certain versions of this package are vulnerable to information exposure, particularly when the style attribute is allowed, which can lead to unintended file system disclosures.
Vulnerability Detail
Versions of the node-sanitize-html package prior to 2.12.1 are susceptible to an Information Exposure vulnerability. This issue arises when the package is used on the backend with the style attribute enabled, allowing attackers to enumerate files within the system, including sensitive project dependencies. The vulnerability can lead to the exposure of the file system structure and critical information about the server's configuration, potentially facilitating further attacks.
How To Fix
Minimum fixed version
2.13.0+~2.11.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-sanitize-htmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of the style attribute in your sanitization settings. This can be done by configuring the options in the sanitize-html function as follows:
const cleanHtml = sanitizeHtml(dirtyHtml, { allowedAttributes: { '*': ['href', 'src'] } });
This configuration will prevent the style attribute from being processed, mitigating the risk of information exposure.
Conclusion
The information exposure vulnerability in the node-sanitize-html package poses significant risks to applications that utilize this library. It is crucial for developers to update to the patched version to safeguard their applications against potential exploitation. Additionally, employing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for node-sanitize-html →
FAQ
node-sanitize-html is a library for sanitizing HTML content in Node.js applications, preventing XSS attacks by allowing developers to specify safe HTML elements and attributes.
Versions prior to 2.12.1 of the node-sanitize-html package are vulnerable to the information exposure issue.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow attackers to gain insights into the file system structure and dependencies of the targeted server, potentially leading to further attacks.
Yes, you can temporarily mitigate the risk by disabling the style attribute in your sanitization settings, as described in the workaround section.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-sanitize-html.
