Is CVE-2016-1000237 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-1000237 being exploited in the wild.

How severe is CVE-2016-1000237?

Low severity, with a CVSS score of 3.1, published 16 April 2020.

Which products and versions are affected?

sanitize-html (npm) SEMVER:introduced=0,fixed=1.4.3.

Is there a fix for CVE-2016-1000237?

Yes. sanitize-html (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-1000237 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-1000237?

Check whether you run sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-1000237: ApostropheCMS sanitize-html Cross-Site Scripting via non-recursive filtering

CVE-2016-1000237 · Severity: low · CVSS 3.1 · Published 2020-04-16

A security vulnerability exists in sanitize-html, a popular tool used by web applications to clean user-provided content and prevent malicious code execution. Because the tool fails to clean input multiple times, an attacker can craft specially formatted text that bypasses security filters. If successful, this could allow an attacker to run unauthorized scripts in a user's browser, potentially leading to account takeover or the theft of sensitive information.

Technologies: sanitize-html (npm). Vendors: npm.

Quick answers

Is CVE-2016-1000237 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-1000237 being exploited in the wild.
How severe is CVE-2016-1000237?: Low severity, with a CVSS score of 3.1, published 16 April 2020.
Which products and versions are affected?: sanitize-html (npm) SEMVER:introduced=0,fixed=1.4.3.
Is there a fix for CVE-2016-1000237?: Yes. sanitize-html (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-1000237 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-1000237?: Check whether you run sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sanitize-html (npm): upgrade to 1.4.3 or later
```
npm install sanitize-html@1.4.3
```

Technical details

The sanitize-html library before version 1.4.3 is vulnerable to Cross-Site Scripting (XSS) due to a lack of recursive sanitization. The parser fails to account for 'masking attacks' where malicious tags are nested within other tags (e.g., `<<img src="x"/>img src="x"/>`). When the outer tag is stripped, the inner malicious tag remains and is rendered by the browser. An unauthenticated remote attacker can exploit this by providing specially crafted HTML input to an application using this library. This allows for the execution of arbitrary JavaScript in the context of the victim's browser session. The issue was addressed in version 1.4.3 by implementing recursive invocation of the sanitization logic.

Affected products

ApostropheCMS sanitize-html < 1.4.3

Identifiers

CVE-2016-1000237
GHSA-3j7m-hmh3-9jmp

Timeline

2014-10-14: disclosed: Issue first reported on GitHub
2020-01-23: advisory: NVD published CVE-2016-1000237
2020-04-16: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.