CVE-2024-28243
📋 TL;DR
KaTeX users who render untrusted mathematical expressions are vulnerable to a denial-of-service attack. Malicious input using the \edef command can cause near-infinite loops that bypass maxExpand protections, leading to memory overflow, main thread blocking, or stack overflow. This affects any web application using KaTeX to render user-provided mathematical content.
💻 Affected Systems
- KaTeX
⚠️ Risk & Real-World Impact
Worst Case
Complete denial-of-service where client browsers become unresponsive, server resources are exhausted, and affected web applications become unavailable to users.
Likely Case
Availability degradation where specific users or sessions experience browser freezes, high CPU usage, and inability to interact with KaTeX-rendered content.
If Mitigated
Minimal impact if input validation filters \edef commands or if KaTeX is only used for trusted content.
🎯 Exploit Status
Exploitation requires only the ability to submit mathematical expressions containing \edef commands to be rendered by KaTeX.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.16.10
Vendor Advisory: https://github.com/KaTeX/KaTeX/security/advisories/GHSA-64fm-8hw2-v72w
Restart Required: No
Instructions:
1. Update KaTeX dependency to version 0.16.10 or later. 2. For npm: 'npm update katex'. 3. For yarn: 'yarn upgrade katex'. 4. For direct script inclusion: update CDN link or local file to v0.16.10+.
🔧 Temporary Workarounds
Input Sanitization
allFilter or block mathematical expressions containing \edef commands before passing to KaTeX renderer.
Isolate Rendering
allRun KaTeX rendering in a separate worker thread or sandboxed environment to limit impact on main application.
🧯 If You Can't Patch
- Implement strict input validation to reject or sanitize mathematical expressions containing \edef commands.
- Limit KaTeX usage to trusted content only and disable rendering of user-provided mathematical expressions.
🔍 How to Verify
Check if Vulnerable:
Check KaTeX version in package.json, package-lock.json, or via 'npm list katex' command. If version is below 0.16.10 and application renders untrusted math expressions, it is vulnerable.Check Version:
npm list katex | grep katexVerify Fix Applied:
Confirm KaTeX version is 0.16.10 or higher via version check, then test rendering of mathematical expressions containing \edef to ensure no infinite loops occur.📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- Browser crash reports
- Unusually long processing times for mathematical expression rendering
Network Indicators:
- Increased client-side resource consumption when loading pages with KaTeX
SIEM Query:
source="application_logs" AND ("KaTeX" OR "math render") AND ("high cpu" OR "timeout" OR "crash")🔗 References
- https://github.com/KaTeX/KaTeX/commit/e88b4c357f978b1bca8edfe3297f0aa309bcbe34
- https://github.com/KaTeX/KaTeX/security/advisories/GHSA-64fm-8hw2-v72w
- https://github.com/github/advisory-database/pull/6777
- https://github.com/KaTeX/KaTeX/commit/e88b4c357f978b1bca8edfe3297f0aa309bcbe34
- https://github.com/KaTeX/KaTeX/security/advisories/GHSA-64fm-8hw2-v72w
