Skip to content

Commit e86d6a6

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@5b14b03 
1 parent 67cecc4 commit e86d6a6

File tree

5 files changed

+645
-0
lines changed

5 files changed

+645
-0
lines changed

‎advisories/_posts/2024-12-02-CVE-2024-53985.md

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2024-53985 (rails-html-sanitizer): rails-html-sanitizer has XSS vulnerability
4+
with certain configurations'
5+
comments: false
6+
categories:
7+
- rails-html-sanitizer
8+
- rails
9+
advisory:
10+
gem: rails-html-sanitizer
11+
framework: rails
12+
cve: 2024-53985
13+
ghsa: w8gc-x259-rc7x
14+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x
15+
title: rails-html-sanitizer has XSS vulnerability with certain configurations
16+
date: 2024-12-02
17+
description: |
18+
## Summary
19+
20+
There is a possible XSS vulnerability with certain configurations of
21+
Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and
22+
Nokogiri < 1.15.7, or 1.16.x < 1.16.8.
23+
24+
* Versions affected: 1.6.0
25+
* Not affected: < 1.6.0
26+
* Fixed versions: 1.6.1
27+
28+
Please note that the fix in v1.6.1 is to update the dependency on
29+
Nokogiri to 1.15.7 or >= 1.16.8.
30+
31+
## Impact
32+
33+
A possible XSS vulnerability with certain configurations of
34+
Rails::HTML::Sanitizer may allow an attacker to inject content if
35+
HTML5 sanitization is enabled and the application developer has
36+
overridden the sanitizer's allowed tags in either of the following ways:
37+
38+
* allow both "math" and "style" elements
39+
* or allow both "svg" and "style" elements
40+
41+
Code is only impacted if Rails is configured to use HTML5 sanitization,
42+
please see documentation for
43+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
44+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
45+
for more information on these configuration options.
46+
47+
Code is only impacted if allowed tags are being overridden.
48+
Applications may be doing this in a few different ways:
49+
50+
1. using application configuration to configure Action View
51+
sanitizers' allowed tags:
52+
53+
```ruby
54+
# In config/application.rb
55+
config.action_view.sanitized_allowed_tags = ["math", "style"]
56+
# or
57+
config.action_view.sanitized_allowed_tags = ["svg", "style"]
58+
```
59+
60+
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
61+
62+
2. using a `:tags` option to the Action View helper `sanitize`:
63+
64+
```
65+
<= sanitize @comment.body, tags: ["math", "style"] >
66+
<# or>
67+
<= sanitize @comment.body, tags: ["svg", "style"] >
68+
```
69+
70+
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
71+
72+
3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
73+
74+
```ruby
75+
# class-level option
76+
Rails::HTML5::SafeListSanitizer.allowed_tags = ["math", "style"]
77+
# or
78+
Rails::HTML5::SafeListSanitizer.allowed_tags = ["svg", "style"]
79+
```
80+
81+
(note that this class may also be referenced as
82+
`Rails::Html::SafeListSanitizer`)
83+
84+
4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer
85+
instance method `sanitize`:
86+
87+
```ruby
88+
# instance-level option
89+
Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
90+
# or
91+
Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", "style"])
92+
```
93+
(note that this class may also be referenced as `Rails::Html::SafeListSanitizer`)
94+
95+
5. setting ActionText::ContentHelper module attribute `allowed_tags`:
96+
97+
```ruby
98+
ActionText::ContentHelper.allowed_tags = ["math", "style"]
99+
# or
100+
ActionText::ContentHelper.allowed_tags = ["svg", "style"]
101+
```
102+
103+
All users overriding the allowed tags by any of the above mechanisms
104+
to include (("math" or "svg") and "style") should either upgrade or
105+
use one of the workarounds.
106+
107+
## Workarounds
108+
109+
Any one of the following actions will work around this issue:
110+
111+
- Remove "style" from the overridden allowed tags,
112+
- Or, remove "math" and "svg" from the overridden allowed tags,
113+
- Or, downgrade sanitization to HTML4 (see documentation for
114+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
115+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
116+
for more information)
117+
- Or, independently upgrade Nokogiri to v1.15.7 or >= 1.16.8.
118+
119+
## References
120+
121+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
122+
- Original report: https://hackerone.com/reports/2503220
123+
124+
## Credit
125+
126+
This vulnerability was responsibly reported by HackerOne user
127+
[@taise](https://hackerone.com/taise?type=user).
128+
cvss_v4: 2.3
129+
unaffected_versions:
130+
- "< 1.6.0"
131+
patched_versions:
132+
- ">= 1.6.1"
133+
related:
134+
url:
135+
- https://nvd.nist.gov/vuln/detail/CVE-2024-53985
136+
- https://github.com/rails/rails-html-sanitizer/blob/v1.6.1/CHANGELOG.md
137+
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x
138+
- https://github.com/rails/rails-html-sanitizer/commit/b0220b8850d52199a15f83c472d175a4122dd7b1
139+
- https://github.com/rails/rails-html-sanitizer/commit/cd18b0ef00aad1d4a9e1c5d860cd23f80f63c505
140+
- https://github.com/advisories/GHSA-w8gc-x259-rc7x
141+
---

‎advisories/_posts/2024-12-02-CVE-2024-53986.md

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2024-53986 (rails-html-sanitizer): rails-html-sanitizer has XSS vulnerability
4+
with certain configurations'
5+
comments: false
6+
categories:
7+
- rails-html-sanitizer
8+
- rails
9+
advisory:
10+
gem: rails-html-sanitizer
11+
framework: rails
12+
cve: 2024-53986
13+
ghsa: 638j-pmjw-jq48
14+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48
15+
title: rails-html-sanitizer has XSS vulnerability with certain configurations
16+
date: 2024-12-02
17+
description: |
18+
## Summary
19+
20+
There is a possible XSS vulnerability with certain configurations of
21+
Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.
22+
23+
* Versions affected: 1.6.0
24+
* Not affected: < 1.6.0
25+
* Fixed versions: 1.6.1
26+
27+
## Impact
28+
29+
A possible XSS vulnerability with certain configurations of
30+
Rails::HTML::Sanitizer may allow an attacker to inject content if
31+
HTML5 sanitization is enabled and the application developer has
32+
overridden the sanitizer's allowed tags in the following way:
33+
34+
- the "math" and "style" elements are both explicitly allowed
35+
36+
Code is only impacted if Rails is configured to use HTML5 sanitization,
37+
please see documentation for
38+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
39+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
40+
for more information on these configuration options.
41+
42+
The default configuration is to disallow these elements. Code is only
43+
impacted if allowed tags are being overridden. Applications may be
44+
doing this in a few different ways:
45+
46+
1. using application configuration to configure Action View sanitizers'
47+
allowed tags:
48+
49+
```ruby
50+
# In config/application.rb
51+
config.action_view.sanitized_allowed_tags = ["math", "style"]
52+
```
53+
54+
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
55+
56+
2. using a `:tags` option to the Action View helper `sanitize`:
57+
58+
```
59+
<= sanitize @comment.body, tags: ["math", "style"]>
60+
```
61+
62+
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
63+
64+
3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
65+
66+
```ruby
67+
# class-level option
68+
Rails::HTML5::SafeListSanitizer.allowed_tags = ["math", "style"]
69+
```
70+
71+
(note that this class may also be referenced as
72+
`Rails::Html::SafeListSanitizer`)
73+
74+
4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer
75+
instance method `sanitize`:
76+
77+
```ruby
78+
# instance-level option
79+
Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
80+
```
81+
82+
(note that this class may also be referenced as
83+
`Rails::Html::SafeListSanitizer`)
84+
85+
5. setting ActionText::ContentHelper module attribute `allowed_tags`:
86+
87+
```ruby
88+
ActionText::ContentHelper.allowed_tags = ["math", "style"]
89+
```
90+
91+
All users overriding the allowed tags by any of the above mechanisms
92+
to include both "math" and "style" should either upgrade or use one
93+
of the workarounds.
94+
95+
## Workarounds
96+
97+
Any one of the following actions will work around this issue:
98+
99+
- Remove "math" or "style" from the overridden allowed tags,
100+
- Or, downgrade sanitization to HTML4 (see documentation for
101+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
102+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
103+
for more information).
104+
105+
## References
106+
107+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
108+
- Original report: https://hackerone.com/reports/2519941
109+
110+
## Credit
111+
112+
This vulnerability was responsibly reported by So Sakaguchi (mokusou).
113+
cvss_v4: 2.3
114+
unaffected_versions:
115+
- "< 1.6.0"
116+
patched_versions:
117+
- ">= 1.6.1"
118+
related:
119+
url:
120+
- https://nvd.nist.gov/vuln/detail/CVE-2024-53986
121+
- https://github.com/rails/rails-html-sanitizer/blob/v1.6.1/CHANGELOG.md
122+
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48
123+
- https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
124+
- https://github.com/advisories/GHSA-638j-pmjw-jq48
125+
---

‎advisories/_posts/2024-12-02-CVE-2024-53987.md

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2024-53987 (rails-html-sanitizer): rails-html-sanitizer has XSS vulnerability
4+
with certain configurations'
5+
comments: false
6+
categories:
7+
- rails-html-sanitizer
8+
- rails
9+
advisory:
10+
gem: rails-html-sanitizer
11+
framework: rails
12+
cve: 2024-53987
13+
ghsa: 2x5m-9ch4-qgrr
14+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
15+
title: rails-html-sanitizer has XSS vulnerability with certain configurations
16+
date: 2024-12-02
17+
description: |
18+
## Summary
19+
20+
There is a possible XSS vulnerability with certain configurations of
21+
Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.
22+
23+
* Versions affected: 1.6.0
24+
* Not affected: < 1.6.0
25+
* Fixed versions: 1.6.1
26+
27+
## Impact
28+
29+
A possible XSS vulnerability with certain configurations of
30+
Rails::HTML::Sanitizer may allow an attacker to inject content if
31+
HTML5 sanitization is enabled and the application developer has
32+
overridden the sanitizer's allowed tags in the following way:
33+
34+
- the "style" element is explicitly allowed
35+
- the "svg" or "math" element is not allowed
36+
37+
Code is only impacted if Rails is configured to use HTML5 sanitization,
38+
please see documentation for [`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
39+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
40+
for more information on these configuration options.
41+
42+
The default configuration is to disallow all of these elements. Code
43+
is only impacted if allowed tags are being overridden. Applications
44+
may be doing this in a few different ways:
45+
46+
1. using application configuration to configure Action View sanitizers'
47+
allowed tags:
48+
49+
```ruby
50+
# In config/application.rb
51+
config.action_view.sanitized_allowed_tags = ["style"]
52+
```
53+
54+
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
55+
56+
2. using a `:tags` option to the Action View helper `sanitize`:
57+
58+
```
59+
<= sanitize @comment.body, tags: ["style"] >
60+
```
61+
62+
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
63+
64+
3. setting Rails::HTML5::SafeListSanitizer class attribute `allowed_tags`:
65+
66+
```ruby
67+
# class-level option
68+
Rails::HTML5::SafeListSanitizer.allowed_tags = ["style"]
69+
```
70+
71+
(note that this class may also be referenced as
72+
`Rails::Html::SafeListSanitizer`)
73+
74+
4. using a `:tags` options to the Rails::HTML5::SafeListSanitizer instance method `sanitize`:
75+
76+
```ruby
77+
# instance-level option
78+
Rails::HTML5::SafeListSanitizer.new.sanitize(@article.body, tags: ["style"])
79+
```
80+
81+
(note that this class may also be referenced as
82+
`Rails::Html::SafeListSanitizer`)
83+
84+
5. setting ActionText::ContentHelper module attribute `allowed_tags`:
85+
86+
```ruby
87+
ActionText::ContentHelper.allowed_tags = ["style"]
88+
```
89+
90+
All users overriding the allowed tags by any of the above mechanisms
91+
to include "style" and omit "svg" or "math" should either upgrade
92+
or use one of the workarounds.
93+
94+
## Workarounds
95+
96+
Any one of the following actions will work around this issue:
97+
98+
- Remove "style" from the overridden allowed tags,
99+
- Or, downgrade sanitization to HTML4 (see documentation for
100+
[`config.action_view.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-view-sanitizer-vendor)
101+
and [`config.action_text.sanitizer_vendor`](https://guides.rubyonrails.org/configuring.html#config-action-text-sanitizer-vendor)
102+
for more information).
103+
104+
## References
105+
106+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
107+
- Original report: https://hackerone.com/reports/2519936
108+
109+
## Credit
110+
111+
This vulnerability was responsibly reported by So Sakaguchi (mnokusou).
112+
cvss_v4: 2.3
113+
unaffected_versions:
114+
- "< 1.6.0"
115+
patched_versions:
116+
- ">= 1.6.1"
117+
related:
118+
url:
119+
- https://nvd.nist.gov/vuln/detail/CVE-2024-53987
120+
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
121+
- https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
122+
- https://github.com/advisories/GHSA-2x5m-9ch4-qgrr
123+
---

0 commit comments

Comments
 (0)