REDHAT-BUG-2266111: Medium severity npm/sanitize-html vulnerability
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf https://github.com/apostrophecms/apostrophe/discussions/4436 https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 https://github.com/apostrophecms/sanitize-html/pull/650 https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sanitize-htmlto a version that resolves this vulnerability.Fixed in 2.12.1 - Configuration
If using sanitize-html on the backend, do not allow the style attribute until you upgrade; versions of sanitize-html before 2.12.1 are vulnerable when used on the backend and with the style attribute allowed.
sanitize-html style attribute allowed = disallow style attribute on backend usage
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2266111?
The severity of REDHAT-BUG-2266111 is classified as critical due to the potential for information exposure.
How do I fix REDHAT-BUG-2266111?
To fix REDHAT-BUG-2266111, update the sanitize-html package to version 2.12.1 or later.
What causes the vulnerability in REDHAT-BUG-2266111?
The vulnerability in REDHAT-BUG-2266111 is caused by allowing the style attribute on the backend, which can lead to information exposure.
Which applications are affected by REDHAT-BUG-2266111?
Applications using sanitize-html versions prior to 2.12.1 are affected by REDHAT-BUG-2266111.
What can an attacker do with exploit REDHAT-BUG-2266111?
An attacker exploiting REDHAT-BUG-2266111 could enumerate files in the system, including project dependencies.