Executive brief
sanitize-html is a Node.js library used to strip potentially malicious HTML from user input. A flaw in its iframe hostname validation allows attackers to bypass the whitelist of allowed iframe sources when relative URLs are enabled, potentially enabling injection of iframes pointing to attacker-controlled or unintended domains. This could lead to cross-site scripting or credential theft if untrusted HTML is processed and displayed to users.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in sanitize-html versions before 2.3.2. When the allowIframeRelativeUrls option is enabled, the library fails to properly validate hostnames specified in the allowedIframeHostnames whitelist. An attacker can bypass this whitelist using a specially crafted src value beginning with a forward slash followed by a backslash and a domain name (e.g., "/\example.com"), exploiting differences in how the WHATWG URL parser and browsers interpret URL components. The fix, merged in PR #460, implements proper protocol cleaning before URL parsing to address the inconsistency. No authentication or special preconditions are required; any application processing untrusted HTML with this option enabled is vulnerable.
Affected products
- Apostrophe Technologies sanitize-html before 2.3.2
Timeline
- 2021-02-08: disclosed: Published on NVD
- 2021-01-26: patched: Fixed in version 2.3.2