CVE-2017-16016: sanitize-html cross-site scripting via nonTextTags

CVE-2017-16016 · Severity: info · CVSS 6.1 · Published 2018-11-09

sanitize-html is a widely-used Node.js library that removes potentially dangerous HTML and scripts from user-supplied content. When configured to allow certain HTML tags (nonTextTags), the library fails to properly escape HTML entities, allowing attackers to inject malicious JavaScript that will execute in the context of a user's browser. This can lead to account takeover, credential theft, or defacement depending on how the library is deployed.

Technologies: sanitize-html (npm). Vendors: npm.

Quick answers

Is CVE-2017-16016 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2017-16016 being exploited in the wild.
How severe is CVE-2017-16016?
Informational severity, with a CVSS score of 6.1, published 9 November 2018.
Which products and versions are affected?
sanitize-html (npm) <1.11.4.
Is there a fix for CVE-2017-16016?
A patch was published on 2017: Fixed in version 1.11.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-16016 attacked?
It is attacked over the network.
Am I affected by CVE-2017-16016?
Check whether you run sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the sanitize-html library's ontext() method, which processes text content within allowed tags. When a nonTextTag (such as textarea) is in the allowedTags configuration, the library pre-decodes HTML entities via htmlparser2, then fails to re-escape them before concatenating the text into the output. An attacker can exploit this by nesting specially-crafted HTML payloads that break out of the intended tag context and inject arbitrary HTML/JavaScript. The attack requires the victim application to use sanitize-html with at least one nonTextTag in the allowedTags option. The vulnerability was fixed in version 1.11.4.

Affected products

  • npm sanitize-html <1.11.4

Identifiers

  • CVE-2017-16016
  • GHSA-xc6g-ggrc-qq4r

Timeline

  • 2016-03-26: disclosed: Issue opened on GitHub
  • 2017: patched: Fixed in version 1.11.4
  • 2018-11-09: advisory: GHSA-xc6g-ggrc-qq4r published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.