Is CVE-2024-28246 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-28246 being exploited in the wild.

How severe is CVE-2024-28246?

Low severity, with a CVSS score of 3.1, published 25 March 2024.

Which products and versions are affected?

katex (npm) SEMVER:introduced=0.11.0,fixed=0.16.10.

Is there a fix for CVE-2024-28246?

Yes. katex (npm): upgrade to 0.16.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-28246 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-28246?

Check whether you run katex (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-28246: KaTeX protocol normalization bypass in trust option

CVE-2024-28246 · Severity: low · CVSS 3.1 · Published 2024-03-25

KaTeX is a popular JavaScript library used to display mathematical formulas on websites. A security flaw in how it handles web links allows attackers to bypass security filters by using uppercase letters in link protocols (like using 'Javascript:' instead of 'javascript:'). This could allow an attacker to inject malicious scripts into a page, potentially leading to unauthorized actions or data theft when a user clicks a link.

Technologies: katex (npm). Vendors: npm.

Quick answers

Is CVE-2024-28246 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-28246 being exploited in the wild.
How severe is CVE-2024-28246?: Low severity, with a CVSS score of 3.1, published 25 March 2024.
Which products and versions are affected?: katex (npm) SEMVER:introduced=0.11.0,fixed=0.16.10.
Is there a fix for CVE-2024-28246?: Yes. katex (npm): upgrade to 0.16.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-28246 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-28246?: Check whether you run katex (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

katex (npm): upgrade to 0.16.10 or later
```
npm install katex@0.16.10
```

Technical details

KaTeX contains a vulnerability where the 'trust' option, used to filter or block-list specific URL protocols, fails to normalize the protocol string to lowercase before evaluation. An attacker can bypass security filters that check for forbidden protocols (such as 'javascript:') by providing mixed-case or uppercase versions (e.g., 'JAVASCRIPT:'). This occurs because the internal context object provided to the user-specified trust function treats 'file:' and 'File:' as distinct. If a developer uses a block-list approach for security, an attacker can successfully inject malicious links. The issue is resolved in version 0.16.10 by forcing protocols to lowercase during the filtering process.

Affected products

KaTeX katex >= 0.11.0, < 0.16.10

Identifiers

CVE-2024-28246
GHSA-3wc5-fcw2-2329

Timeline

2024-03-24: patched: Fix committed to repository
2024-03-25: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.