CVE-2021-33391
📋 TL;DR
CVE-2021-33391 is a use-after-free vulnerability in HTACG HTML Tidy that allows attackers to execute arbitrary code via the -g option in the CleanNode() function. This affects systems using vulnerable versions of HTML Tidy for HTML parsing or cleanup. Attackers can achieve remote code execution with high privileges.
💻 Affected Systems
- HTACG HTML Tidy
- Applications embedding HTML Tidy library
- Systems using tidy command-line tool
📦 What is this software?
Tidy by Htacg
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root/admin privileges leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Remote code execution leading to web server compromise, data exfiltration, or lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation, minimal privileges, and exploit prevention controls in place.
🎯 Exploit Status
The vulnerability is in a widely used library with public proof-of-concept available. Exploitation requires feeding malicious input to the vulnerable function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.8.0 and later
Vendor Advisory: https://github.com/htacg/tidy-html5/issues/946
Restart Required: Yes
Instructions:
1. Update HTML Tidy to version 5.8.0 or later. 2. For package managers: 'apt update && apt upgrade tidy' (Debian/Ubuntu) or 'yum update tidy' (RHEL/CentOS). 3. Recompile applications using the library. 4. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation before passing data to HTML Tidy functions
Disable Vulnerable Function
allAvoid using the -g option or CleanNode() function with untrusted input
🧯 If You Can't Patch
- Implement network segmentation to isolate systems using HTML Tidy
- Apply strict input validation and sanitization before HTML Tidy processing
🔍 How to Verify
Check if Vulnerable:
Check HTML Tidy version with 'tidy -v' or examine application dependencies for versions <= 5.7.28Check Version:
tidy -vVerify Fix Applied:
Confirm version is 5.8.0 or later with 'tidy -v' and test with known malicious inputs📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from web server context
- Crash logs from HTML Tidy processes
- Memory corruption errors in application logs
Network Indicators:
- Unusual outbound connections from web servers
- Exploit kit traffic patterns
SIEM Query:
process_name:tidy AND (event_type:crash OR parent_process:web_server)