gsd - gsd-2022-23520

gsd-2022-23520

Vulnerability from gsd

Modified

2022-12-13 00:00

Details

## Summary There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209. - Versions affected: ALL - Not affected: NONE - Fixed versions: 1.4.4 ## Impact A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements. Code is only impacted if allowed tags are being overridden using either of the following two mechanisms: 1. Using the Rails configuration `config.action_view.sanitized_allow_tags=`: ```ruby # In config/application.rb config.action_view.sanitized_allowed_tags = ["select", "style"] ``` (see https://guides.rubyonrails.org/configuring.html#configuring-action-view) 2. Using the class method `Rails::Html::SafeListSanitizer.allowed_tags=`: ```ruby # class-level option Rails::Html::SafeListSanitizer.allowed_tags = ["select", "style"] ``` All users overriding the allowed tags by either of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately. NOTE: Code is _not_ impacted if allowed tags are overridden using either of the following mechanisms: - the `:tags` option to the Action View helper method `sanitize`. - the `:tags` option to the instance method `SafeListSanitizer#sanitize`. ## Workarounds Remove either "select" or "style" from the overridden allowed tags.

Aliases

CVE-2022-23520

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-23520",
    "id": "GSD-2022-23520",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-23520.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "rails-html-sanitizer",
            "purl": "pkg:gem/rails-html-sanitizer"
          }
        }
      ],
      "aliases": [
        "CVE-2022-23520",
        "GHSA-rrfc-7g8p-99q8"
      ],
      "details": "## Summary\n\nThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209.\n\n- Versions affected: ALL\n- Not affected: NONE\n- Fixed versions: 1.4.4\n\n## Impact\n\nA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer\u0027s allowed tags to allow both \"select\" and \"style\" elements.\n\nCode is only impacted if allowed tags are being overridden using either of the following two mechanisms:\n\n1. Using the Rails configuration `config.action_view.sanitized_allow_tags=`:\n\n  ```ruby\n  # In config/application.rb\n  config.action_view.sanitized_allowed_tags = [\"select\", \"style\"]\n  ```\n\n  (see https://guides.rubyonrails.org/configuring.html#configuring-action-view)\n\n2. Using the class method `Rails::Html::SafeListSanitizer.allowed_tags=`:\n\n  ```ruby\n  # class-level option\n  Rails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]\n  ```\n\nAll users overriding the allowed tags by either of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.\n\nNOTE: Code is _not_ impacted if allowed tags are overridden using either of the following mechanisms:\n\n- the `:tags` option to the Action View helper method `sanitize`.\n- the `:tags` option to the instance method `SafeListSanitizer#sanitize`.\n\n## Workarounds\n\nRemove either \"select\" or \"style\" from the overridden allowed tags.\n",
      "id": "GSD-2022-23520",
      "modified": "2022-12-13T00:00:00.000Z",
      "published": "2022-12-13T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8"
        },
        {
          "type": "WEB",
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "type": "WEB",
          "url": "https://hackerone.com/reports/1654310"
        }
      ],
      "related": [
        "CVE-2022-32209"
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 6.1,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Possible XSS vulnerability with certain configurations of rails-html-sanitizer"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-23520",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "rails-html-sanitizer",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 1.4.4"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "rails"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer\u0027s allowed tags to allow both \"select\" and \"style\" elements. Code is only impacted if allowed tags are being overridden. This issue is patched in version 1.4.4. All users overriding the allowed tags to include both \"select\" and \"style\" should either upgrade or use this workaround: Remove either \"select\" or \"style\" from the overridden allowed tags. NOTE: Code is _not_ impacted if allowed tags are overridden using either the :tags option to the Action View helper method sanitize or the :tags option to the instance method SafeListSanitizer#sanitize.\n"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-79",
                "lang": "eng",
                "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8",
            "refsource": "MISC",
            "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8"
          },
          {
            "name": "https://hackerone.com/reports/1654310",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/1654310"
          },
          {
            "name": "https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html",
            "refsource": "MISC",
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-rrfc-7g8p-99q8",
        "discovery": "UNKNOWN"
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2022-23520",
      "cvss_v3": 6.1,
      "date": "2022-12-13",
      "description": "## Summary\n\nThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209.\n\n- Versions affected: ALL\n- Not affected: NONE\n- Fixed versions: 1.4.4\n\n## Impact\n\nA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer\u0027s allowed tags to allow both \"select\" and \"style\" elements.\n\nCode is only impacted if allowed tags are being overridden using either of the following two mechanisms:\n\n1. Using the Rails configuration `config.action_view.sanitized_allow_tags=`:\n\n  ```ruby\n  # In config/application.rb\n  config.action_view.sanitized_allowed_tags = [\"select\", \"style\"]\n  ```\n\n  (see https://guides.rubyonrails.org/configuring.html#configuring-action-view)\n\n2. Using the class method `Rails::Html::SafeListSanitizer.allowed_tags=`:\n\n  ```ruby\n  # class-level option\n  Rails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]\n  ```\n\nAll users overriding the allowed tags by either of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.\n\nNOTE: Code is _not_ impacted if allowed tags are overridden using either of the following mechanisms:\n\n- the `:tags` option to the Action View helper method `sanitize`.\n- the `:tags` option to the instance method `SafeListSanitizer#sanitize`.\n\n## Workarounds\n\nRemove either \"select\" or \"style\" from the overridden allowed tags.\n",
      "gem": "rails-html-sanitizer",
      "ghsa": "rrfc-7g8p-99q8",
      "patched_versions": [
        "\u003e= 1.4.4"
      ],
      "related": {
        "cve": [
          "2022-32209"
        ],
        "url": [
          "https://cwe.mitre.org/data/definitions/79.html",
          "https://hackerone.com/reports/1654310"
        ]
      },
      "title": "Possible XSS vulnerability with certain configurations of rails-html-sanitizer",
      "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.4.4",
          "affected_versions": "All versions before 1.4.4",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2022-12-16",
          "description": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer\u0027s allowed tags to allow both \"select\" and \"style\" elements. Code is only impacted if allowed tags are being overridden. This issue is patched in version 1.4.4. All users overriding the allowed tags to include both \"select\" and \"style\" should either upgrade or use this workaround: Remove either \"select\" or \"style\" from the overridden allowed tags. NOTE: Code is _not_ impacted if allowed tags are overridden using either the :tags option to the Action View helper method sanitize or the :tags option to the instance method SafeListSanitizer#sanitize.",
          "fixed_versions": [
            "1.4.4"
          ],
          "identifier": "CVE-2022-23520",
          "identifiers": [
            "CVE-2022-23520",
            "GHSA-rrfc-7g8p-99q8",
            "GMS-2022-8301"
          ],
          "not_impacted": "All versions starting from 1.4.4",
          "package_slug": "gem/rails-html-sanitizer",
          "pubdate": "2022-12-14",
          "solution": "Upgrade to version 1.4.4 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-23520",
            "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8",
            "https://hackerone.com/reports/1654310",
            "https://github.com/advisories/GHSA-rrfc-7g8p-99q8"
          ],
          "uuid": "b5395528-c6a1-4df6-9cae-ca71e0e81b01"
        },
        {
          "affected_range": "\u003c0",
          "affected_versions": "All versions before 1.4.4",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2022-12-13",
          "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) in rails-html-sanitizer.",
          "fixed_versions": [
            "1.4.4"
          ],
          "identifier": "GMS-2022-8301",
          "identifiers": [
            "GHSA-rrfc-7g8p-99q8",
            "GMS-2022-8301",
            "CVE-2022-23520"
          ],
          "not_impacted": "All versions starting from 1.4.4",
          "package_slug": "gem/rails-html-sanitizer",
          "pubdate": "2022-12-13",
          "solution": "Upgrade to version 1.4.4 or above.",
          "title": "Duplicate of ./gem/rails-html-sanitizer/CVE-2022-23520.yml",
          "urls": [
            "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8",
            "https://hackerone.com/reports/1654310",
            "https://github.com/advisories/GHSA-rrfc-7g8p-99q8"
          ],
          "uuid": "1515fe2b-9bcf-441e-91ab-89112b251965"
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:rubyonrails:rails_html_sanitizers:*:*:*:*:*:rails:*:*",
                    "matchCriteriaId": "CC2FBD9D-39C2-4D54-83B6-B3C334623A8D",
                    "versionEndExcluding": "1.4.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer\u0027s allowed tags to allow both \"select\" and \"style\" elements. Code is only impacted if allowed tags are being overridden. This issue is patched in version 1.4.4. All users overriding the allowed tags to include both \"select\" and \"style\" should either upgrade or use this workaround: Remove either \"select\" or \"style\" from the overridden allowed tags. NOTE: Code is _not_ impacted if allowed tags are overridden using either the :tags option to the Action View helper method sanitize or the :tags option to the instance method SafeListSanitizer#sanitize.\n"
          },
          {
            "lang": "es",
            "value": "rails-html-sanitizer es responsable de sanitizar fragmentos HTML en aplicaciones Rails. Antes de la versi\u00f3n 1.4.4, existe una posible vulnerabilidad XSS con ciertas configuraciones de Rails::Html::Sanitizer debido a una soluci\u00f3n incompleta de CVE-2022-32209. Rails::Html::Sanitizer puede permitir que un atacante inyecte contenido si el desarrollador de la aplicaci\u00f3n ha anulado las etiquetas permitidas del sanitizador para permitir elementos de \"select\" y \"style\". El c\u00f3digo solo se ve afectado si se anulan las etiquetas permitidas. Este problema se solucion\u00f3 en la versi\u00f3n 1.4.4. Todos los usuarios que anulen las etiquetas permitidas para incluir \"select\" y \"style\" deben actualizar o utilizar el workaround: eliminar \"select\" o \"style\" de las etiquetas permitidas anuladas. NOTA: El c\u00f3digo _no_ se ve afectado si las etiquetas permitidas se anulan usando la opci\u00f3n :tags para el m\u00e9todo auxiliar sanitizador de Action View o la opci\u00f3n :tags para el m\u00e9todo de instancia SafeListSanitizer#sanitize."
          }
        ],
        "id": "CVE-2022-23520",
        "lastModified": "2024-02-01T16:52:23.247",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2022-12-14T18:15:17.560",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://hackerone.com/reports/1654310"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

cve-2022-23520

Vulnerability from cvelistv5

Published

2022-12-14 17:07

Modified

2024-08-03 03:43

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

rails-html-sanitizer contains an incomplete fix for an XSS vulnerability

References

▼	URL	Tags
	https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8	x_refsource_CONFIRM
	https://hackerone.com/reports/1654310	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html

Impacted products

▼	Vendor	Product
	rails	rails-html-sanitizer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:43:46.436Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8"
          },
          {
            "name": "https://hackerone.com/reports/1654310",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1654310"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rails-html-sanitizer",
          "vendor": "rails",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer\u0027s allowed tags to allow both \"select\" and \"style\" elements. Code is only impacted if allowed tags are being overridden. This issue is patched in version 1.4.4. All users overriding the allowed tags to include both \"select\" and \"style\" should either upgrade or use this workaround: Remove either \"select\" or \"style\" from the overridden allowed tags. NOTE: Code is _not_ impacted if allowed tags are overridden using either the :tags option to the Action View helper method sanitize or the :tags option to the instance method SafeListSanitizer#sanitize.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-14T17:07:31.954Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8"
        },
        {
          "name": "https://hackerone.com/reports/1654310",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1654310"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html"
        }
      ],
      "source": {
        "advisory": "GHSA-rrfc-7g8p-99q8",
        "discovery": "UNKNOWN"
      },
      "title": "rails-html-sanitizer contains an incomplete fix for an XSS vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-23520",
    "datePublished": "2022-12-14T17:07:31.954Z",
    "dateReserved": "2022-01-19T21:23:53.780Z",
    "dateUpdated": "2024-08-03T03:43:46.436Z",
    "requesterUserId": "c184a3d9-dc98-4c48-a45b-d2d88cf0ac74",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-rrfc-7g8p-99q8

Vulnerability from github

Published

2022-12-13 17:51

Modified

2022-12-17 00:32

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Details

Summary

There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209.

Versions affected: ALL
Not affected: NONE
Fixed versions: 1.4.4

Impact

A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements.

Code is only impacted if allowed tags are being overridden using either of the following two mechanisms:

Using the Rails configuration config.action_view.sanitized_allow_tags=:

ruby # In config/application.rb config.action_view.sanitized_allowed_tags = ["select", "style"]

(see https://guides.rubyonrails.org/configuring.html#configuring-action-view)

Using the class method Rails::Html::SafeListSanitizer.allowed_tags=:

ruby # class-level option Rails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]

All users overriding the allowed tags by either of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.

NOTE: Code is not impacted if allowed tags are overridden using either of the following mechanisms:

the :tags option to the Action View helper method sanitize.
the :tags option to the instance method SafeListSanitizer#sanitize.

Workarounds

Remove either "select" or "style" from the overridden allowed tags.

References

CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32209
https://hackerone.com/reports/1654310

Credit

This vulnerability was responsibly reported by Dominic Breuker.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "rails-html-sanitizer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-23520"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-13T17:51:40Z",
    "nvd_published_at": "2022-12-14T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209.\n\n- Versions affected: ALL\n- Not affected: NONE\n- Fixed versions: 1.4.4\n\n\n## Impact\n\nA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer\u0027s allowed tags to allow both \"select\" and \"style\" elements.\n\nCode is only impacted if allowed tags are being overridden using either of the following two mechanisms:\n\n1. Using the Rails configuration `config.action_view.sanitized_allow_tags=`:\n\n  ```ruby\n  # In config/application.rb\n  config.action_view.sanitized_allowed_tags = [\"select\", \"style\"]\n  ```\n\n  (see https://guides.rubyonrails.org/configuring.html#configuring-action-view)\n\n2. Using the class method `Rails::Html::SafeListSanitizer.allowed_tags=`:\n\n  ```ruby\n  # class-level option\n  Rails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]\n  ```\n\nAll users overriding the allowed tags by either of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.\n\nNOTE: Code is _not_ impacted if allowed tags are overridden using either of the following mechanisms:\n\n- the `:tags` option to the Action View helper method `sanitize`.\n- the `:tags` option to the instance method `SafeListSanitizer#sanitize`.\n\n\n## Workarounds\n\nRemove either \"select\" or \"style\" from the overridden allowed tags.\n\n\n## References\n\n- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) (4.9)](https://cwe.mitre.org/data/definitions/79.html)\n- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32209\n- https://hackerone.com/reports/1654310\n\n\n## Credit\n\nThis vulnerability was responsibly reported by Dominic Breuker.\n",
  "id": "GHSA-rrfc-7g8p-99q8",
  "modified": "2022-12-17T00:32:44Z",
  "published": "2022-12-13T17:51:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23520"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1654310"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rails/rails-html-sanitizer"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2022-23520.yml"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Possible XSS vulnerability with certain configurations of rails-html-sanitizer"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

gsd-2022-23520

Vulnerability from gsd

cve-2022-23520

Vulnerability from cvelistv5

ghsa-rrfc-7g8p-99q8

Vulnerability from github

Summary

Impact

Workarounds

References

Credit

Tags

Sightings

Nomenclature