CVE-2024-21501 sanitize-html Information Exposure vulnerability
An attacker can enumerate server files and dependencies if the style attribute is allowed, exposing sensitive system structure information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21501?
CVE-2024-21501 is a medium-severity vulnerability in Fedoraproject Fedora, published on 24 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
Which versions are affected by CVE-2024-21501?
2 open source packages ship an affected version, including sanitize-html. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
sanitize-html npm | All versions | 2.12.1 |
sanitize-html npm | All versions | 2.12.1 |
Products include Apostrophecms Sanitize-Html, Fedoraproject Fedora.
How do I fix CVE-2024-21501?
Upgrade sanitize-html to 2.12.1 or later.
Is CVE-2024-21501 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21501 exists.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2014-125128 Cross-site scripting in apostrophecms:sanitize-html
- CVE-2019-25225 sanitize-html is vulnerable to XSS through incomprehensive sanitization
- CVE-2016-1000237 Cross-Site Scripting in sanitize-html
- CVE-2022-25887 Regular Expression Denial of Service (ReDoS)
- CVE-2021-26539 Improper Input Validation in sanitize-html
Sources
Also known as DEBIAN-CVE-2024-21501, GHSA-rm97-x556-q36h, ROOT-APP-NPM-CVE-2024-21501, UBUNTU-CVE-2024-21501.