Executive brief
html-janitor is a JavaScript library used to sanitize user-supplied HTML content, removing potentially malicious code. A flaw in its sanitization logic allows attackers to bypass the filtering and inject malicious JavaScript (XSS), which executes in the context of the affected application and can steal user data or hijack sessions.
Technical details
html-janitor is vulnerable to DOM clobbering attacks that allow bypass of its HTML sanitization mechanism, enabling cross-site scripting (XSS). The vulnerability exists in all versions prior to 2.0.4 and occurs when user-controlled input is passed to the clean() function. An attacker can craft HTML payloads that exploit DOM property shadowing to circumvent the sanitization filters, allowing arbitrary script injection. The vulnerability is network-accessible if the affected application accepts and processes user input through html-janitor without additional controls. Upgrading to version 2.0.4 or later resolves the issue.
Affected products
- html-janitor html-janitor < 2.0.4
Timeline
- 2018-07-24: disclosed
- 2018-07-24: patched: version 2.0.4 released