CVE-2024-28244: KaTeX's maxExpand bypassed by Unicode sub/superscripts
Impact KaTeX users who render untrusted mathematical expressions could encounter malicious input using \def or \newcommand that causes a near-infinite loop, despite setting maxExpand to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow.
Patches Upgrade to KaTeX v0.16.10 to remove this vulnerability.
Workarounds Forbid inputs containing any of the characters ₊₋₌₍₎₀₁₂₃₄₅₆₇₈₉ₐₑₕᵢⱼₖₗₘₙₒₚᵣₛₜᵤᵥₓᵦᵧᵨᵩᵪ⁺⁻⁼⁽⁾⁰¹²³⁴⁵⁶⁷⁸⁹ᵃᵇᶜᵈᵉᵍʰⁱʲᵏˡᵐⁿᵒᵖʳˢᵗᵘʷˣʸᶻᵛᵝᵞᵟᵠᵡ before passing them to KaTeX. (There is no easy workaround for the auto-render extension.)
Details KaTeX supports an option named maxExpand which aims to prevent infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. Unfortunately, support for "Unicode (sub|super)script characters" allows an attacker to bypass this limit. Each sub/superscript group instantiated a separate Parser with its own limit on macro executions, without inheriting the current count of macro executions from its parent. This has been corrected in KaTeX v0.16.10.
For more information If you have any questions or comments about this advisory: Open an issue or security advisory in the KaTeX repository Email us at katex-security@mit.edu
Other sources
KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \def or \newcommand that causes a near-infinite loop, despite setting maxExpand to avoid such loops. KaTeX supports an option named maxExpand which aims to prevent infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. Unfortunately, support for "Unicode (sub|super)script characters" allows an attacker to bypass this limit. Each sub/superscript group instantiated a separate Parser with its own limit on macro executions, without inheriting the current count of macro executions from its parent. This has been corrected in KaTeX v0.16.10.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28244?
CVE-2024-28244 is classified with high severity due to its potential for causing denial of service through infinite loops.
How do I fix CVE-2024-28244?
To fix CVE-2024-28244, upgrade KaTeX to version 0.16.10 or later.
Who is affected by CVE-2024-28244?
Users of KaTeX versions between 0.15.4 and 0.16.10 are affected by CVE-2024-28244.
What kind of attack does CVE-2024-28244 enable?
CVE-2024-28244 enables an availability attack by allowing attackers to render malicious mathematical expressions that could lead to a denial of service.
When was CVE-2024-28244 first reported?
CVE-2024-28244 was first reported in early 2024, affecting users of the KaTeX library.