Lucene search

K
hackeroneArthurnnH1:81396
HistoryAug 09, 2015 - 11:32 a.m.

Ruby on Rails: [Rails42] We can inject HTML tags when server is using strip_tags method

2015-08-0911:32:40
arthurnn
hackerone.com
17

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

65.4%

XSS vulnerability in rails-html-sanitizer

There is a XSS vulnerability in Rails::Html::FullSanitizer used by Action View’s strip_tags.
This vulnerability has been assigned the CVE identifier CVE-2015-7579.

Versions Affected: 1.0.2
Not affected: 1.0.0, 1.0.1
Fixed Versions: 1.0.3

Impact

Due to the way that Rails::Html::FullSanitizer is implemented, if an attacker
passes an already escaped HTML entity to the input of Action View’s strip_tags
these entities will be unescaped what may cause a XSS attack if used in combination
with raw or html_safe.

For example:

strip_tags("<script>alert('XSS')</script>")

Would generate:

<script>alert('XSS')</script>

After the fix it will generate:

<script>alert('XSS')</script>

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases

The FIXED releases are available at the normal locations.

Workarounds

If you can’t upgrade, please use the following monkey patch in an initializer
that is loaded before your application:

$ cat config/initializers/strip_tags_fix.rb
class ActionView::Base
  def strip_tags(html)
    self.class.full_sanitizer.sanitize(html)
  end
end

Patches

To aid users who aren’t able to upgrade immediately we have provided patches
for the two supported release series. They are in git-am format and consist
of a single changeset.

  • Do-not-unescape-already-escaped-HTML-entities.patch

Credits

Thank you to Arthur Neves from GitHub and Spyros Livathinos from Zendesk for
reporting the problem and working with us to fix it.

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

65.4%