Critical ReDoS Vulnerability in libhtml-stripscripts-perl Package
Summary
UBUNTU-CVE-2023-24038: The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attributes. Affects libhtml-stripscripts-perl versions < 1.05-1ubuntu0.1~esm1. Fixed in 1.05-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libhtml-stripscripts-perl is a Perl module designed to strip scripts from HTML content, enhancing security by preventing the execution of potentially harmful scripts. This package is widely used in web applications to sanitize user input and ensure safe HTML rendering. However, it has been found to be vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can lead to significant performance degradation under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2023-24038, allows attackers to exploit the _hss_attval_style function in the HTML-StripScripts module through version 1.06. The issue arises from catastrophic backtracking in regular expressions when processing HTML content with specific style attributes. This can lead to excessive CPU consumption, causing the application to become unresponsive. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.05-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libhtml-stripscripts-perlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize user inputs before processing them with the libhtml-stripscripts-perl module. This can help mitigate the risk of ReDoS attacks by ensuring that only safe HTML content is processed.
Conclusion
The libhtml-stripscripts-perl package has a critical vulnerability that can lead to denial of service through ReDoS attacks. It is crucial to update to the latest patched versions to mitigate this risk. Users should also consider using Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for libhtml-stripscripts-perl →
FAQ
CVE-2023-24038 is a vulnerability in the libhtml-stripscripts-perl package that allows for a Regular Expression Denial of Service (ReDoS) attack.
Exploitation of this vulnerability can lead to excessive CPU usage, causing your application to become unresponsive, which can affect user experience.
Versions up to 1.06 are affected, with specific patched versions available for various Ubuntu distributions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Implement input validation to sanitize user inputs as a temporary measure to reduce the risk of exploitation until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for libhtml-stripscripts-perl.
