CVE-2024-21501: Infoleak
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/sanitize-htmlto a version that resolves this vulnerability.Fixed in 2.12.1 - Upgrade
Upgrade
sanitize-htmlto a version that resolves this vulnerability.Fixed in 2.12.1 - Configuration
Do not allow the HTML "style" attribute when using sanitize-html on the backend (vulnerable when style attribute is allowed).
sanitize-html style attribute allowed = disallow
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21501?
CVE-2024-21501 has a medium severity level due to its potential for information exposure.
How do I fix CVE-2024-21501?
To fix CVE-2024-21501, update the sanitize-html package to version 2.12.1 or later.
Who is affected by CVE-2024-21501?
CVE-2024-21501 affects versions of the sanitize-html package prior to 2.12.1 used in backend applications.
What kind of attack can exploit CVE-2024-21501?
An attacker can exploit CVE-2024-21501 to enumerate files in the system, including project dependencies.
Should I be concerned about using sanitize-html with allowed style attributes?
Yes, using sanitize-html with allowed style attributes can increase the risk of CVE-2024-21501 being exploited.