Skip to content

Commit 1950dd6

Browse files
flavorjonesflavorjones
authored
add CVEs for loofah and rails-html-sanitizer (#531)
1 parent 560bce9 commit 1950dd6

File tree

7 files changed

+328
-0
lines changed

7 files changed

+328
-0
lines changed

‎gems/loofah/CVE-2022-23514.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
gem: loofah
3+
cve: 2022-23514
4+
ghsa: 486f-hjj9-9vhh
5+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh
6+
title: "Inefficient Regular Expression Complexity in Loofah"
7+
date: 2022-12-13
8+
description: |
9+
## Summary
10+
11+
Loofah `< 2.19.1` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.
12+
13+
14+
## Mitigation
15+
16+
Upgrade to Loofah `>= 2.19.1`.
17+
18+
19+
## Severity
20+
21+
The Loofah maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
22+
23+
24+
## References
25+
26+
- [CWE - CWE-1333: Inefficient Regular Expression Complexity (4.9)](https://cwe.mitre.org/data/definitions/1333.html)
27+
- https://hackerone.com/reports/1684163
28+
29+
30+
## Credit
31+
32+
This vulnerability was responsibly reported by @ooooooo-q (https://github.com/ooooooo-q).
33+
cvss_v3: 7.5
34+
patched_versions:
35+
- ">= 2.19.1"

‎gems/loofah/CVE-2022-23515.yml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
gem: loofah
3+
cve: 2022-23515
4+
ghsa: 228g-948r-83gx
5+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx
6+
title: "Improper neutralization of data URIs may allow XSS in Loofah"
7+
date: 2022-12-13
8+
description: |
9+
## Summary
10+
11+
Loofah `>= 2.1.0, < 2.19.1` is vulnerable to cross-site scripting via the `image/svg+xml` media type in data URIs.
12+
13+
14+
## Mitigation
15+
16+
Upgrade to Loofah `>= 2.19.1`.
17+
18+
19+
## Severity
20+
21+
The Loofah maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
22+
23+
24+
## References
25+
26+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
27+
- [SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg](https://github.com/w3c/svgwg/issues/266)
28+
- https://hackerone.com/reports/1694173
29+
- https://github.com/flavorjones/loofah/issues/101
30+
31+
## Credit
32+
33+
This vulnerability was responsibly reported by Maciej Piechota (@haqpl).
34+
cvss_v3: 6.1
35+
unaffected_versions:
36+
- "< 2.1.0"
37+
patched_versions:
38+
- ">= 2.19.1"

‎gems/loofah/CVE-2022-23516.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
gem: loofah
3+
cve: 2022-23516
4+
ghsa: 3x8r-x6xp-q4vm
5+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm
6+
title: "Uncontrolled Recursion in Loofah"
7+
date: 2022-12-13
8+
description: |
9+
## Summary
10+
11+
Loofah `>= 2.2.0, < 2.19.1` uses recursion for sanitizing `CDATA` sections, making it susceptible to stack exhaustion and raising a `SystemStackError` exception. This may lead to a denial of service through CPU resource consumption.
12+
13+
14+
## Mitigation
15+
16+
Upgrade to Loofah `>= 2.19.1`.
17+
18+
Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
19+
20+
21+
## Severity
22+
23+
The Loofah maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
24+
25+
26+
## References
27+
28+
- [CWE - CWE-674: Uncontrolled Recursion (4.9)](https://cwe.mitre.org/data/definitions/674.html)
29+
cvss_v3: 7.5
30+
unaffected_versions:
31+
- "< 2.2.0"
32+
patched_versions:
33+
- ">= 2.19.1"

‎gems/rails-html-sanitizer/CVE-2022-23517.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
gem: rails-html-sanitizer
3+
cve: 2022-23517
4+
ghsa: 5x79-w82f-gw8w
5+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w
6+
title: "Inefficient Regular Expression Complexity in rails-html-sanitizer"
7+
date: 2022-12-13
8+
description: |
9+
## Summary
10+
11+
Certain configurations of rails-html-sanitizer `< 1.4.4` use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.
12+
13+
14+
## Mitigation
15+
16+
Upgrade to rails-html-sanitizer `>= 1.4.4`.
17+
18+
19+
## Severity
20+
21+
The maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
22+
23+
24+
## References
25+
26+
- [CWE - CWE-1333: Inefficient Regular Expression Complexity (4.9)](https://cwe.mitre.org/data/definitions/1333.html)
27+
- https://hackerone.com/reports/1684163
28+
29+
30+
## Credit
31+
32+
This vulnerability was responsibly reported by @ooooooo-q (https://github.com/ooooooo-q).
33+
cvss_v3: 7.5
34+
patched_versions:
35+
- ">= 1.4.4"

‎gems/rails-html-sanitizer/CVE-2022-23518.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
gem: rails-html-sanitizer
3+
cve: 2022-23518
4+
ghsa: mcvf-2q2m-x72m
5+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m
6+
title: "Improper neutralization of data URIs may allow XSS in rails-html-sanitizer"
7+
date: 2022-12-13
8+
description: |
9+
## Summary
10+
11+
rails-html-sanitizer `>= 1.0.3, < 1.4.4` is vulnerable to cross-site scripting via data URIs when used in combination with Loofah `>= 2.1.0`.
12+
13+
14+
## Mitigation
15+
16+
Upgrade to rails-html-sanitizer `>= 1.4.4`.
17+
18+
19+
## Severity
20+
21+
The maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
22+
23+
24+
## References
25+
26+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
27+
- [SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg](https://github.com/w3c/svgwg/issues/266)
28+
- https://github.com/rails/rails-html-sanitizer/issues/135
29+
- https://hackerone.com/reports/1694173
30+
31+
32+
## Credit
33+
34+
This vulnerability was independently reported by Maciej Piechota (@haqpl) and Mrinmoy Das (@goromlagche).
35+
cvss_v3: 6.1
36+
unaffected_versions:
37+
- "< 1.0.3"
38+
patched_versions:
39+
- ">= 1.4.4"

‎gems/rails-html-sanitizer/CVE-2022-23519.yml

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
gem: rails-html-sanitizer
3+
cve: 2022-23519
4+
ghsa: 9h9g-93gc-623h
5+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g-93gc-623h
6+
title: "Possible XSS vulnerability with certain configurations of rails-html-sanitizer"
7+
date: 2022-12-13
8+
description: |
9+
## Summary
10+
11+
There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
12+
13+
- Versions affected: ALL
14+
- Not affected: NONE
15+
- Fixed versions: 1.4.4
16+
17+
18+
## Impact
19+
20+
A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways:
21+
22+
- allow both "math" and "style" elements,
23+
- or allow both "svg" and "style" elements
24+
25+
Code is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:
26+
27+
1. using application configuration:
28+
29+
```ruby
30+
# In config/application.rb
31+
config.action_view.sanitized_allowed_tags = ["math", "style"]
32+
# or
33+
config.action_view.sanitized_allowed_tags = ["svg", "style"]
34+
```
35+
36+
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
37+
38+
2. using a `:tags` option to the Action View helper `sanitize`:
39+
40+
```
41+
<%= sanitize @comment.body, tags: ["math", "style"] %>
42+
<%# or %>
43+
<%= sanitize @comment.body, tags: ["svg", "style"] %>
44+
```
45+
46+
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
47+
48+
3. using Rails::Html::SafeListSanitizer class method `allowed_tags=`:
49+
50+
```ruby
51+
# class-level option
52+
Rails::Html::SafeListSanitizer.allowed_tags = ["math", "style"]
53+
# or
54+
Rails::Html::SafeListSanitizer.allowed_tags = ["svg", "style"]
55+
```
56+
57+
4. using a `:tags` options to the Rails::Html::SafeListSanitizer instance method `sanitize`:
58+
59+
```ruby
60+
# instance-level option
61+
Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
62+
# or
63+
Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", "style"])
64+
```
65+
66+
All users overriding the allowed tags by any of the above mechanisms to include (("math" or "svg") and "style") should either upgrade or use one of the workarounds immediately.
67+
68+
69+
## Workarounds
70+
71+
Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
72+
73+
74+
## References
75+
76+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
77+
- https://hackerone.com/reports/1656627
78+
79+
80+
## Credit
81+
82+
This vulnerability was responsibly reported by Dominic Breuker.
83+
patched_versions:
84+
- ">= 1.4.4"

‎gems/rails-html-sanitizer/CVE-2022-23520.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
gem: rails-html-sanitizer
3+
cve: 2022-23520
4+
ghsa: rrfc-7g8p-99q8
5+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8
6+
title: "Possible XSS vulnerability with certain configurations of rails-html-sanitizer"
7+
date: 2022-12-13
8+
description: |
9+
## Summary
10+
11+
There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209.
12+
13+
- Versions affected: ALL
14+
- Not affected: NONE
15+
- Fixed versions: 1.4.4
16+
17+
18+
## Impact
19+
20+
A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements.
21+
22+
Code is only impacted if allowed tags are being overridden using either of the following two mechanisms:
23+
24+
1. Using the Rails configuration `config.action_view.sanitized_allow_tags=`:
25+
26+
```ruby
27+
# In config/application.rb
28+
config.action_view.sanitized_allowed_tags = ["select", "style"]
29+
```
30+
31+
(see https://guides.rubyonrails.org/configuring.html#configuring-action-view)
32+
33+
2. Using the class method `Rails::Html::SafeListSanitizer.allowed_tags=`:
34+
35+
```ruby
36+
# class-level option
37+
Rails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]
38+
```
39+
40+
All users overriding the allowed tags by either of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.
41+
42+
NOTE: Code is _not_ impacted if allowed tags are overridden using either of the following mechanisms:
43+
44+
- the `:tags` option to the Action View helper method `sanitize`.
45+
- the `:tags` option to the instance method `SafeListSanitizer#sanitize`.
46+
47+
48+
## Workarounds
49+
50+
Remove either "select" or "style" from the overridden allowed tags.
51+
52+
53+
## References
54+
55+
- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
56+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32209
57+
- https://hackerone.com/reports/1654310
58+
59+
60+
## Credit
61+
62+
This vulnerability was responsibly reported by Dominic Breuker.
63+
patched_versions:
64+
- ">= 1.4.4"

0 commit comments

Comments
 (0)