Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1wZzh2LWc0eHEtaHd3Oc4AAs-c
Rails::Html::Sanitizer vulnerable to Cross-site Scripting
Versions of Rails::Html::Sanitizer prior to version 1.4.3 are vulnerable to XSS with certain configurations of Rails::Html::Sanitizer which allows an attacker to inject content when the application developer has overridden the sanitizer's allowed tags to allow both select
and style
elements. Code is only impacted if allowed tags are being overridden.
This may be done via application configuration: ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
Or it may be done with a :tags
option to the Action View helper sanitize
: <%= sanitize @comment.body, tags: ["select", "style"] %>
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
It may also be done with Rails::Html::SafeListSanitizer directly:
ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]
or with
ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])
All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" are recommended to upgrade immediately. A workaround for this issue can be applied by removing either select
or style
from the overridden allowed tags.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZzh2LWc0eHEtaHd3Oc4AAs-c
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 2 months ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-pg8v-g4xq-hww9, CVE-2022-32209
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-32209
- https://hackerone.com/reports/1530898
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2022-32209.yml
- https://groups.google.com/g/rubyonrails-security/c/ce9PhUANQ6s
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NHDACMCLWE32BZZTSNWQPIFUAD5I6Q47/
- https://lists.debian.org/debian-lts-announce/2022/12/msg00012.html
- https://github.com/rails/rails-html-sanitizer/commit/45a5c10fed3d9aa141594c80afa06d748fa0967d
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHDACMCLWE32BZZTSNWQPIFUAD5I6Q47/
- https://github.com/advisories/GHSA-pg8v-g4xq-hww9
Affected Packages
rubygems:rails-html-sanitizer
Dependent packages: 30Dependent repositories: 517,903
Downloads: 428,586,794 total
Affected Version Ranges: < 1.4.3
Fixed in: 1.4.3
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.4.1, 1.4.2
All unaffected versions: 1.4.3, 1.4.4, 1.5.0, 1.6.0