Описание
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
A flaw was found in rails-html-sanitizer, a component responsible for sanitizing HTML fragments in Rails applications. This vulnerability allows a remote attacker to perform Cross-Site Scripting (XSS) by exploiting improper sanitization of SVG (Scalable Vector Graphics) reference elements. The Rails::HTML::PermitScrubber component failed to restrict the href attribute in SVG elements, which browsers accept in addition to xlink:href. This oversight could enable an attacker to execute malicious scripts in the context of the sanitized document or load external images for tracking, affecting applications configured with non-default allowed SVG tags.
Отчет
rails-html-sanitizer sanitizes HTML fragments in Rails applications. This issue is a cross-site scripting vulnerability affecting versions 1.0.3 through 1.7.0. Exploitation requires that the application has overridden the sanitizer's default allowed tags to include SVG reference elements such as use or feImage. Applications that use the default allowed tags are not affected. The issue is fixed in version 1.7.1. Red Hat rates this Moderate.
Меры по смягчению последствий
If the sanitizer's allowed tags have been overridden, remove SVG reference elements such as use and feImage from that list. Applications using the default allowed tags are not affected. Upgrade to rails-html-sanitizer 1.7.1 or later where a fix is available.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel9 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel9 | Fix deferred | ||
| Red Hat Satellite 6 | rubygem-rails-html-sanitizer | Fix deferred | ||
| Red Hat Satellite 6 | satellite:el8/rubygem-rails-html-sanitizer | Fix deferred | ||
| Red Hat Satellite 6 | tfm-rubygem-graphql | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
5.4 Medium
CVSS3
Связанные уязвимости
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
rails-html-sanitizer is responsible for sanitizing HTML fragments in R ...
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations
5.4 Medium
CVSS3