Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-9h9g-93gc-623h: Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Summary

There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

  • Versions affected: ALL
  • Not affected: NONE
  • Fixed versions: 1.4.4

Impact

A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer’s allowed tags in either of the following ways:

  • allow both “math” and “style” elements,
  • or allow both “svg” and “style” elements

Code is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:

  1. using application configuration:
# In config/application.rb
config.action_view.sanitized_allowed_tags = ["math", "style"]
# or
config.action_view.sanitized_allowed_tags = ["svg", "style"]

see https://guides.rubyonrails.org/configuring.html#configuring-action-view

  1. using a :tags option to the Action View helper sanitize:
<%= sanitize @comment.body, tags: ["math", "style"] %>
<%# or %>
<%= sanitize @comment.body, tags: ["svg", "style"] %>

see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize

  1. using Rails::Html::SafeListSanitizer class method allowed_tags=:
# class-level option
Rails::Html::SafeListSanitizer.allowed_tags = ["math", "style"]
# or
Rails::Html::SafeListSanitizer.allowed_tags = ["svg", "style"]
  1. using a :tags options to the Rails::Html::SafeListSanitizer instance method sanitize:
# instance-level option
Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
# or
Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", "style"])

All users overriding the allowed tags by any of the above mechanisms to include ((“math” or “svg”) and “style”) should either upgrade or use one of the workarounds immediately.

Workarounds

Remove “style” from the overridden allowed tags, or remove “math” and “svg” from the overridden allowed tags.

References

Credit

This vulnerability was responsibly reported by Dominic Breuker.

ghsa
#xss#vulnerability#web#ruby

Summary

There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

  • Versions affected: ALL
  • Not affected: NONE
  • Fixed versions: 1.4.4

Impact

A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer’s allowed tags in either of the following ways:

  • allow both “math” and “style” elements,
  • or allow both “svg” and “style” elements

Code is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:

  1. using application configuration:

# In config/application.rb config.action_view.sanitized_allowed_tags = ["math", “style”] # or config.action_view.sanitized_allowed_tags = ["svg", “style”]

see https://guides.rubyonrails.org/configuring.html#configuring-action-view

  1. using a :tags option to the Action View helper sanitize:

    <%= sanitize @comment.body, tags: ["math", “style”] %> <%# or %> <%= sanitize @comment.body, tags: ["svg", “style”] %>

see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize

  1. using Rails::Html::SafeListSanitizer class method allowed_tags=:

# class-level option Rails::Html::SafeListSanitizer.allowed_tags = ["math", “style”] # or Rails::Html::SafeListSanitizer.allowed_tags = ["svg", “style”]

  1. using a :tags options to the Rails::Html::SafeListSanitizer instance method sanitize:

# instance-level option Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", “style”]) # or Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", “style”])

All users overriding the allowed tags by any of the above mechanisms to include ((“math” or “svg”) and “style”) should either upgrade or use one of the workarounds immediately.

Workarounds

Remove “style” from the overridden allowed tags, or remove “math” and “svg” from the overridden allowed tags.

References

  • CWE - CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) (4.9)
  • https://hackerone.com/reports/1656627

Credit

This vulnerability was responsibly reported by Dominic Breuker.

References

  • GHSA-9h9g-93gc-623h
  • https://hackerone.com/reports/1656627

Related news

Red Hat Security Advisory 2023-2097-03

Red Hat Security Advisory 2023-2097-03 - Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Issues addressed include code execution, cross site scripting, denial of service, deserialization, improper neutralization, information leakage, and remote shell upload vulnerabilities.

CVE-2022-23519

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.