Skip to content

Commit 5b14b03

Browse files
jasnowpostmodern
jasnow
authored and
postmodern
committed
GHSA SYNC: 5 brand new advisories
1 parent 6d4c89f commit 5b14b03

File tree

5 files changed

+600
-0
lines changed

5 files changed

+600
-0
lines changed

Diff for: ‎gems/rails-html-sanitizer/CVE-2024-53985.yml

+132
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
gem: rails-html-sanitizer
3+
framework: rails
4+
cve: 2024-53985
5+
ghsa: w8gc-x259-rc7x
6+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x
7+
title: rails-html-sanitizer has XSS vulnerability with certain configurations
8+
date: 2024-12-02
9+
description: |
10+
## Summary
11+
12+
There is a possible XSS vulnerability with certain configurations of
13+
Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and
14+
Nokogiri < 1.15.7, or 1.16.x < 1.16.8.
15+
16+
* Versions affected: 1.6.0
17+
* Not affected: < 1.6.0
18+
* Fixed versions: 1.6.1
19+
20+
Please note that the fix in v1.6.1 is to update the dependency on
21+
Nokogiri to 1.15.7 or >= 1.16.8.
22+
23+
## Impact
24+
25+
A possible XSS vulnerability with certain configurations of
26+
Rails::HTML::Sanitizer may allow an attacker to inject content if
27+
HTML5 sanitization is enabled and the application developer has
28+
overridden the sanitizer's allowed tags in either of the following ways:
29+
30+
* allow both "math" and "style" elements
31+
* or allow both "svg" and "style" elements
32+
33+
Code is only impacted if Rails is configured to use HTML5 sanitization,
34+
please see documentation for
35+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
36+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
37+
for more information on these configuration options.
38+
39+
Code is only impacted if allowed tags are being overridden.
40+
Applications may be doing this in a few different ways:
41+
42+
1. using application configuration to configure Action View
43+
sanitizers' allowed tags:
44+
45+
```ruby
46+
# In config/application.rb
47+
config.action_view.sanitized_allowed_tags = ["math", "style"]
48+
# or
49+
config.action_view.sanitized_allowed_tags = ["svg", "style"]
50+
```
51+
52+
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
53+
54+
2. using a `:tags` option to the Action View helper `sanitize`:
55+
56+
```
57+
<= sanitize @comment.body, tags: ["math", "style"] >
58+
<# or>
59+
<= sanitize @comment.body, tags: ["svg", "style"] >
60+
```
61+
62+
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
63+
64+
3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
65+
66+
```ruby
67+
# class-level option
68+
Rails::HTML5::SafeListSanitizer.allowed_tags = ["math", "style"]
69+
# or
70+
Rails::HTML5::SafeListSanitizer.allowed_tags = ["svg", "style"]
71+
```
72+
73+
(note that this class may also be referenced as
74+
`Rails::Html::SafeListSanitizer`)
75+
76+
4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer
77+
instance method `sanitize`:
78+
79+
```ruby
80+
# instance-level option
81+
Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
82+
# or
83+
Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", "style"])
84+
```
85+
(note that this class may also be referenced as `Rails::Html::SafeListSanitizer`)
86+
87+
5. setting ActionText::ContentHelper module attribute `allowed_tags`:
88+
89+
```ruby
90+
ActionText::ContentHelper.allowed_tags = ["math", "style"]
91+
# or
92+
ActionText::ContentHelper.allowed_tags = ["svg", "style"]
93+
```
94+
95+
All users overriding the allowed tags by any of the above mechanisms
96+
to include (("math" or "svg") and "style") should either upgrade or
97+
use one of the workarounds.
98+
99+
## Workarounds
100+
101+
Any one of the following actions will work around this issue:
102+
103+
- Remove "style" from the overridden allowed tags,
104+
- Or, remove "math" and "svg" from the overridden allowed tags,
105+
- Or, downgrade sanitization to HTML4 (see documentation for
106+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
107+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
108+
for more information)
109+
- Or, independently upgrade Nokogiri to v1.15.7 or >= 1.16.8.
110+
111+
## References
112+
113+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
114+
- Original report: https://hackerone.com/reports/2503220
115+
116+
## Credit
117+
118+
This vulnerability was responsibly reported by HackerOne user
119+
[@taise](https://hackerone.com/taise?type=user).
120+
cvss_v4: 2.3
121+
unaffected_versions:
122+
- "< 1.6.0"
123+
patched_versions:
124+
- ">= 1.6.1"
125+
related:
126+
url:
127+
- https://nvd.nist.gov/vuln/detail/CVE-2024-53985
128+
- https://github.com/rails/rails-html-sanitizer/blob/v1.6.1/CHANGELOG.md
129+
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x
130+
- https://github.com/rails/rails-html-sanitizer/commit/b0220b8850d52199a15f83c472d175a4122dd7b1
131+
- https://github.com/rails/rails-html-sanitizer/commit/cd18b0ef00aad1d4a9e1c5d860cd23f80f63c505
132+
- https://github.com/advisories/GHSA-w8gc-x259-rc7x

Diff for: ‎gems/rails-html-sanitizer/CVE-2024-53986.yml

+116
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
---
2+
gem: rails-html-sanitizer
3+
framework: rails
4+
cve: 2024-53986
5+
ghsa: 638j-pmjw-jq48
6+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48
7+
title: rails-html-sanitizer has XSS vulnerability with certain configurations
8+
date: 2024-12-02
9+
description: |
10+
## Summary
11+
12+
There is a possible XSS vulnerability with certain configurations of
13+
Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.
14+
15+
* Versions affected: 1.6.0
16+
* Not affected: < 1.6.0
17+
* Fixed versions: 1.6.1
18+
19+
## Impact
20+
21+
A possible XSS vulnerability with certain configurations of
22+
Rails::HTML::Sanitizer may allow an attacker to inject content if
23+
HTML5 sanitization is enabled and the application developer has
24+
overridden the sanitizer's allowed tags in the following way:
25+
26+
- the "math" and "style" elements are both explicitly allowed
27+
28+
Code is only impacted if Rails is configured to use HTML5 sanitization,
29+
please see documentation for
30+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
31+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
32+
for more information on these configuration options.
33+
34+
The default configuration is to disallow these elements. Code is only
35+
impacted if allowed tags are being overridden. Applications may be
36+
doing this in a few different ways:
37+
38+
1. using application configuration to configure Action View sanitizers'
39+
allowed tags:
40+
41+
```ruby
42+
# In config/application.rb
43+
config.action_view.sanitized_allowed_tags = ["math", "style"]
44+
```
45+
46+
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
47+
48+
2. using a `:tags` option to the Action View helper `sanitize`:
49+
50+
```
51+
<= sanitize @comment.body, tags: ["math", "style"]>
52+
```
53+
54+
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
55+
56+
3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
57+
58+
```ruby
59+
# class-level option
60+
Rails::HTML5::SafeListSanitizer.allowed_tags = ["math", "style"]
61+
```
62+
63+
(note that this class may also be referenced as
64+
`Rails::Html::SafeListSanitizer`)
65+
66+
4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer
67+
instance method `sanitize`:
68+
69+
```ruby
70+
# instance-level option
71+
Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
72+
```
73+
74+
(note that this class may also be referenced as
75+
`Rails::Html::SafeListSanitizer`)
76+
77+
5. setting ActionText::ContentHelper module attribute `allowed_tags`:
78+
79+
```ruby
80+
ActionText::ContentHelper.allowed_tags = ["math", "style"]
81+
```
82+
83+
All users overriding the allowed tags by any of the above mechanisms
84+
to include both "math" and "style" should either upgrade or use one
85+
of the workarounds.
86+
87+
## Workarounds
88+
89+
Any one of the following actions will work around this issue:
90+
91+
- Remove "math" or "style" from the overridden allowed tags,
92+
- Or, downgrade sanitization to HTML4 (see documentation for
93+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
94+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
95+
for more information).
96+
97+
## References
98+
99+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
100+
- Original report: https://hackerone.com/reports/2519941
101+
102+
## Credit
103+
104+
This vulnerability was responsibly reported by So Sakaguchi (mokusou).
105+
cvss_v4: 2.3
106+
unaffected_versions:
107+
- "< 1.6.0"
108+
patched_versions:
109+
- ">= 1.6.1"
110+
related:
111+
url:
112+
- https://nvd.nist.gov/vuln/detail/CVE-2024-53986
113+
- https://github.com/rails/rails-html-sanitizer/blob/v1.6.1/CHANGELOG.md
114+
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48
115+
- https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
116+
- https://github.com/advisories/GHSA-638j-pmjw-jq48

Diff for: ‎gems/rails-html-sanitizer/CVE-2024-53987.yml

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
gem: rails-html-sanitizer
3+
framework: rails
4+
cve: 2024-53987
5+
ghsa: 2x5m-9ch4-qgrr
6+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
7+
title: rails-html-sanitizer has XSS vulnerability with certain configurations
8+
date: 2024-12-02
9+
description: |
10+
## Summary
11+
12+
There is a possible XSS vulnerability with certain configurations of
13+
Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.
14+
15+
* Versions affected: 1.6.0
16+
* Not affected: < 1.6.0
17+
* Fixed versions: 1.6.1
18+
19+
## Impact
20+
21+
A possible XSS vulnerability with certain configurations of
22+
Rails::HTML::Sanitizer may allow an attacker to inject content if
23+
HTML5 sanitization is enabled and the application developer has
24+
overridden the sanitizer's allowed tags in the following way:
25+
26+
- the "style" element is explicitly allowed
27+
- the "svg" or "math" element is not allowed
28+
29+
Code is only impacted if Rails is configured to use HTML5 sanitization,
30+
please see documentation for [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
31+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
32+
for more information on these configuration options.
33+
34+
The default configuration is to disallow all of these elements. Code
35+
is only impacted if allowed tags are being overridden. Applications
36+
may be doing this in a few different ways:
37+
38+
1. using application configuration to configure Action View sanitizers'
39+
allowed tags:
40+
41+
```ruby
42+
# In config/application.rb
43+
config.action_view.sanitized_allowed_tags = ["style"]
44+
```
45+
46+
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
47+
48+
2. using a `:tags` option to the Action View helper `sanitize`:
49+
50+
```
51+
<= sanitize @comment.body, tags: ["style"] >
52+
```
53+
54+
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
55+
56+
3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
57+
58+
```ruby
59+
# class-level option
60+
Rails::HTML5::SafeListSanitizer.allowed_tags = ["style"]
61+
```
62+
63+
(note that this class may also be referenced as
64+
`Rails::Html::SafeListSanitizer`)
65+
66+
4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer instance method `sanitize`:
67+
68+
```ruby
69+
# instance-level option
70+
Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["style"])
71+
```
72+
73+
(note that this class may also be referenced as
74+
`Rails::Html::SafeListSanitizer`)
75+
76+
5. setting ActionText::ContentHelper module attribute `allowed_tags`:
77+
78+
```ruby
79+
ActionText::ContentHelper.allowed_tags = ["style"]
80+
```
81+
82+
All users overriding the allowed tags by any of the above mechanisms
83+
to include "style" and omit "svg" or "math" should either upgrade
84+
or use one of the workarounds.
85+
86+
## Workarounds
87+
88+
Any one of the following actions will work around this issue:
89+
90+
- Remove "style" from the overridden allowed tags,
91+
- Or, downgrade sanitization to HTML4 (see documentation for
92+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
93+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
94+
for more information).
95+
96+
## References
97+
98+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
99+
- Original report: https://hackerone.com/reports/2519936
100+
101+
## Credit
102+
103+
This vulnerability was responsibly reported by So Sakaguchi (mnokusou).
104+
cvss_v4: 2.3
105+
unaffected_versions:
106+
- "< 1.6.0"
107+
patched_versions:
108+
- ">= 1.6.1"
109+
related:
110+
url:
111+
- https://nvd.nist.gov/vuln/detail/CVE-2024-53987
112+
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
113+
- https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
114+
- https://github.com/advisories/GHSA-2x5m-9ch4-qgrr

0 commit comments

Comments
 (0)