HTML Sanitizer Vulnerability in python-html-sanitizer: Unicode Normalization Flaw
Summary
UBUNTU-CVE-2024-34078: html-sanitizer is an allowlist-based HTML cleaner. Affects python-html-sanitizer versions 1.9.1-2 – 1.9.3-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-html-sanitizer package is an allowlist-based HTML cleaner designed to sanitize HTML content by removing potentially harmful elements while preserving safe ones. It is widely used in web applications to ensure that user-generated content does not introduce security risks. However, a vulnerability has been identified in versions 1.9.3-1 and 2.2-1 of this package, which could allow specially crafted HTML to bypass sanitization under certain conditions.
Vulnerability Detail
The vulnerability arises from the default setting of the 'keep_typographic_whitespace' parameter being set to False. This causes the sanitizer to normalize Unicode characters to the NFKC form at the end of the sanitization process. Some Unicode characters can normalize to chevrons, which allows attackers to craft HTML that escapes the sanitization process. This could lead to the execution of malicious scripts or display of unsafe content, compromising the integrity of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can set the 'keep_typographic_whitespace' parameter to True when using the sanitizer. This can be done in your code as follows: 'sanitizer = HtmlSanitizer(keep_typographic_whitespace=True)'. However, this is not a permanent fix and updating to the patched version is recommended.
Conclusion
The identified vulnerability in the python-html-sanitizer package poses a significant risk by allowing crafted HTML to escape sanitization. It is crucial for users of this package to update to the patched version to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-html-sanitizer →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
Versions 1.9.3-1 and 2.2-1 of python-html-sanitizer are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability allows an attacker to craft HTML that can bypass sanitization, potentially leading to the execution of malicious scripts.
Yes, the permanent fix is to update the python-html-sanitizer package to version 2.4.2 or later, where the issue has been resolved.
Related vulnerabilities
Recent vulnerabilities recorded for python-html-sanitizer.
