CVE-2019-25225
📋 TL;DR
This vulnerability in sanitize-html allows attackers to inject malicious scripts through the custom transformTags option, bypassing HTML sanitization. It affects applications using sanitize-html versions before 2.0.0-beta to clean user-generated content. Developers who rely on this library for XSS protection are impacted.
💻 Affected Systems
- sanitize-html
📦 What is this software?
Sanitize Html by Apostrophecms
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, session hijacking, or data exfiltration through persistent XSS attacks on all users accessing affected content.
Likely Case
Limited XSS attacks affecting users who view malicious content, potentially leading to session theft or client-side attacks.
If Mitigated
No impact if proper input validation and output encoding are implemented alongside sanitize-html, or if transformTags option is not used.
🎯 Exploit Status
Proof of concept available in GitHub repository. Exploitation requires attacker to control input that gets processed with transformTags option.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.0-beta and later
Vendor Advisory: https://github.com/apostrophecms/sanitize-html/issues/293
Restart Required: No
Instructions:
1. Update sanitize-html to version 2.0.0-beta or later using npm: npm update sanitize-html@latest
2. Verify the update with: npm list sanitize-html
3. Test that transformTags functionality still works as expected with safe inputs.
🔧 Temporary Workarounds
Disable transformTags option
allRemove or disable the custom transformTags configuration in sanitize-html usage
Implement additional input validation
allAdd server-side validation to reject suspicious HTML patterns before sanitize-html processing
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact
- Use alternative HTML sanitization libraries like DOMPurify alongside sanitize-html
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list sanitize-html | grep sanitize-htmlCheck Version:
npm list sanitize-html | grep sanitize-htmlVerify Fix Applied:
Verify installed version is 2.0.0-beta or higher: npm list sanitize-html📡 Detection & Monitoring
Log Indicators:
- Unusual HTML patterns in user inputs, especially with script tags or event handlers
Network Indicators:
- Unexpected JavaScript execution from user-generated content
SIEM Query:
Search for web application logs containing suspicious HTML patterns when transformTags is used🔗 References
- https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225
- https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3
- https://github.com/apostrophecms/sanitize-html/issues/293
- https://github.com/apostrophecms/sanitize-html/pull/156
