CVE-2023-34624

What it actually does

The vulnerability permits denial of service through processing of specially crafted objects containing cyclic dependencies, potentially leading to infinite recursion or resource exhaustion in the HTML cleaner library.

Why it matters to the business

Applications using the vulnerable library may experience crashes or unresponsiveness when processing malicious input, leading to service outages; the issue has been public for over three years with public exploits available.

How an attack unfolds

An attacker crafts a malicious object containing cyclic references and supplies it to the htmlcleaner library's processing functions, triggering uncontrolled recursion that exhausts stack or CPU resources; public exploits facilitate this attack.

How to fix it

Upgrade htmlcleaner to a version that properly detects and rejects cyclic object graphs; if no patched release exists, wrap calls with cycle-detection logic or replace the library with a maintained alternative.

How to confirm the fix worked

Inventory all uses of htmlcleaner, confirm the deployed version, and test the library with known cyclic object payloads to verify crashes are prevented after remediation.

Typical attack path

1. Locate an application or service that invokes htmlcleaner on untrusted input
2. Construct an object graph containing cyclic references
3. Submit the crafted object to the vulnerable parsing or cleaning routine
4. Trigger infinite recursion leading to resource exhaustion or crash

How to detect it

Monitor application logs and performance metrics for sudden spikes in CPU or memory usage, or unexpected crashes, when htmlcleaner processes external input; correlate with request logs containing unusual object structures.

What your security team should do

• Prioritize inventorying htmlcleaner usage across all codebases due to the age of the disclosure and public exploit availability
• Implement defensive input validation around htmlcleaner calls to detect cycles before processing
• Evaluate migration to actively maintained HTML sanitization libraries