Headline
GHSA-9h9g-93gc-623h: Possible XSS vulnerability with certain configurations of rails-html-sanitizer
Summary
There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
- Versions affected: ALL
- Not affected: NONE
- Fixed versions: 1.4.4
Impact
A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer’s allowed tags in either of the following ways:
- allow both “math” and “style” elements,
- or allow both “svg” and “style” elements
Code is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:
- using application configuration:
# In config/application.rb
config.action_view.sanitized_allowed_tags = ["math", "style"]
# or
config.action_view.sanitized_allowed_tags = ["svg", "style"]
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
- using a
:tags
option to the Action View helpersanitize
:
<%= sanitize @comment.body, tags: ["math", "style"] %>
<%# or %>
<%= sanitize @comment.body, tags: ["svg", "style"] %>
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
- using Rails::Html::SafeListSanitizer class method
allowed_tags=
:
# class-level option
Rails::Html::SafeListSanitizer.allowed_tags = ["math", "style"]
# or
Rails::Html::SafeListSanitizer.allowed_tags = ["svg", "style"]
- using a
:tags
options to the Rails::Html::SafeListSanitizer instance methodsanitize
:
# instance-level option
Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
# or
Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", "style"])
All users overriding the allowed tags by any of the above mechanisms to include ((“math” or “svg”) and “style”) should either upgrade or use one of the workarounds immediately.
Workarounds
Remove “style” from the overridden allowed tags, or remove “math” and “svg” from the overridden allowed tags.
References
- CWE - CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) (4.9)
- https://hackerone.com/reports/1656627
Credit
This vulnerability was responsibly reported by Dominic Breuker.
Summary
There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
- Versions affected: ALL
- Not affected: NONE
- Fixed versions: 1.4.4
Impact
A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer’s allowed tags in either of the following ways:
- allow both “math” and “style” elements,
- or allow both “svg” and “style” elements
Code is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:
- using application configuration:
# In config/application.rb config.action_view.sanitized_allowed_tags = ["math", “style”] # or config.action_view.sanitized_allowed_tags = ["svg", “style”]
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
using a :tags option to the Action View helper sanitize:
<%= sanitize @comment.body, tags: ["math", “style”] %> <%# or %> <%= sanitize @comment.body, tags: ["svg", “style”] %>
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
- using Rails::Html::SafeListSanitizer class method allowed_tags=:
# class-level option Rails::Html::SafeListSanitizer.allowed_tags = ["math", “style”] # or Rails::Html::SafeListSanitizer.allowed_tags = ["svg", “style”]
- using a :tags options to the Rails::Html::SafeListSanitizer instance method sanitize:
# instance-level option Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", “style”]) # or Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", “style”])
All users overriding the allowed tags by any of the above mechanisms to include ((“math” or “svg”) and “style”) should either upgrade or use one of the workarounds immediately.
Workarounds
Remove “style” from the overridden allowed tags, or remove “math” and “svg” from the overridden allowed tags.
References
- CWE - CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) (4.9)
- https://hackerone.com/reports/1656627
Credit
This vulnerability was responsibly reported by Dominic Breuker.
References
- GHSA-9h9g-93gc-623h
- https://hackerone.com/reports/1656627
Related news
Red Hat Security Advisory 2023-2097-03 - Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Issues addressed include code execution, cross site scripting, denial of service, deserialization, improper neutralization, information leakage, and remote shell upload vulnerabilities.
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.