PT-2022-14898 · Unknown · Express-Xss-Sanitizer

Jayateertha Guruprasad · Published 2022-09-26 · Updated 2024-02-14 · CVE-2022-21169

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions express-xss-sanitizer versions prior to 1.1.3

Description The issue allows attackers to bypass xss sanitization due to Prototype Pollution via the allowedTags attribute. This enables the attacker to exploit the vulnerability, potentially leading to security breaches.

Recommendations For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the allowedTags attribute until a patch is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-21169

GHSA-GRJP-4JMR-MJCW

Affected Products

Express-Xss-Sanitizer

References · 9

• 🔥 https://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443 · Exploit
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39a · Patch
• https://runkit.com/embed/w306l6zfm7tu · Patch
• https://osv.dev/vulnerability/GHSA-grjp-4jmr-mjcw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21169 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21169 · Vendor Advisory
• https://github.com/AhmedAdelFahim/express-xss-sanitizer · Note
• https://t.me/cvenotify/36812 · Telegram Post