Junglewise Threat Intelligence

CVE-2016-1000237: ApostropheCMS sanitize-html Cross-Site Scripting via non-recursive filtering

CVE-2016-1000237 · Severity: low · CVSS 3.1 · Published 2020-04-16

Executive brief

A security vulnerability exists in sanitize-html, a popular tool used by web applications to clean user-provided content and prevent malicious code execution. Because the tool fails to clean input multiple times, an attacker can craft specially formatted text that bypasses security filters. If successful, this could allow an attacker to run unauthorized scripts in a user's browser, potentially leading to account takeover or the theft of sensitive information.

Technical details

The sanitize-html library before version 1.4.3 is vulnerable to Cross-Site Scripting (XSS) due to a lack of recursive sanitization. The parser fails to account for 'masking attacks' where malicious tags are nested within other tags (e.g., `<<img src="x"/>img src="x"/>`). When the outer tag is stripped, the inner malicious tag remains and is rendered by the browser. An unauthenticated remote attacker can exploit this by providing specially crafted HTML input to an application using this library. This allows for the execution of arbitrary JavaScript in the context of the victim's browser session. The issue was addressed in version 1.4.3 by implementing recursive invocation of the sanitization logic.

Affected products

  • ApostropheCMS sanitize-html < 1.4.3

Timeline

  • 2014-10-14: disclosed: Issue first reported on GitHub
  • 2020-01-23: advisory: NVD published CVE-2016-1000237
  • 2020-04-16: advisory: GitHub Advisory published

References

Related threats