CVE-2024-32463 phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags

2024-04-1715:29:14

CWE-79

GitHub_M

github.com

phlex

open-source

xss

1.10.1

1.9.2

1.8.3

content security policy

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

AI Score

5.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an <a> tag could be bypassed with tab \t or newline \n characters between the characters of the protocol, e.g. java\tscript:. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow unsafe-inline would effectively prevent this vulnerability from being exploited.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ruby:fileutils:1.0.0:*:*:*:*:*:*:*"
    ],
    "vendor": "ruby",
    "product": "fileutils",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]