CVE-2024-21501: Infoleak
First published: Sat Feb 24 2024(Updated: )
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
Credit: report@snyk.io report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/sanitize-html | <2.12.1 | 2.12.1 |
| Punkave Sanitize-html | <2.12.1 | |
| Red Hat Fedora | =39 | |
| Red Hat Fedora | =40 |
Remedy
https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557
- https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
- https://github.com/apostrophecms/sanitize-html/pull/650
- https://github.com/apostrophecms/apostrophe/discussions/4436
- https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/
- https://nvd.nist.gov/vuln/detail/CVE-2024-21501
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S
- https://github.com/advisories/GHSA-rm97-x556-q36h (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266114
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266116
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266117
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266115
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266118
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266119
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266120
- https://access.redhat.com/errata/RHSA-2024:1770
- https://access.redhat.com/errata/RHBA-2024:1793
- https://access.redhat.com/errata/RHBA-2024:3593
- https://access.redhat.com/errata/RHBA-2024:1775
- https://access.redhat.com/errata/RHBA-2024:3555
- https://bugzilla.redhat.com/show_bug.cgi?id=2266111
Frequently Asked Questions
What is the severity of CVE-2024-21501?
CVE-2024-21501 has a medium severity level due to its potential for information exposure.
How do I fix CVE-2024-21501?
To fix CVE-2024-21501, update the sanitize-html package to version 2.12.1 or later.
Who is affected by CVE-2024-21501?
CVE-2024-21501 affects versions of the sanitize-html package prior to 2.12.1 used in backend applications.
What kind of attack can exploit CVE-2024-21501?
An attacker can exploit CVE-2024-21501 to enumerate files in the system, including project dependencies.
Should I be concerned about using sanitize-html with allowed style attributes?
Yes, using sanitize-html with allowed style attributes can increase the risk of CVE-2024-21501 being exploited.
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-rm97-x556-q36h
- alias/CVE-2024-21501
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/references
- agent/trending
- collector/redhat-bugzilla
- source/Red Hat
- agent/source
- collector/nvd-api
- agent/last-modified-date
- agent/remedy
- agent/tags
- agent/softwarecombine
- package-manager/npm
- vendor/apostrophecms
- canonical/punkave sanitize-html
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/39
- version/red hat fedora/40