RubySec

Providing security resources for the Ruby community

CVE-2023-36823 (sanitize): Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

ADVISORIES

GEM

sanitize

SEVERITY

CVSS v3.x: 7.1 (High)

UNAFFECTED VERSIONS

  • < 3.0.0

PATCHED VERSIONS

  • >= 6.0.2

DESCRIPTION

Impact

Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize &gt;= 3.0.0, &lt; 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows style elements and one or more CSS at-rules. This could result in XSS (cross-site scripting) or other undesired behavior when the malicious HTML and CSS are rendered in a browser.

Patches

Sanitize &gt;= 6.0.2 performs additional escaping of CSS in style element content, which fixes this issue.

Workarounds

Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow style elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence &lt;/ as &lt;\/ in style element content.

Credit

This issue was found by @cure53 during an audit of a project that uses Sanitize and was reported by one of that project's maintainers. Thank you!

RELATED