github - GHSA-7f42-p84j-f58p

GHSA-7f42-p84j-f58p

Vulnerability from github

Published

2018-03-21 11:56

Modified

2023-01-23 20:47

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

Sanitize vulnerable to Improper Input Validation and Cross-site Scripting

Details

When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements.

This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "sanitize"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "4.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-3740"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:22:33Z",
    "nvd_published_at": "2018-03-30T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "When Sanitize \u003c= 4.6.2 is used in combination with libxml2 \u003e= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements.\n\nThis can allow HTML and JavaScript injection, which could result in XSS if Sanitize\u0027s output is served to browsers.",
  "id": "GHSA-7f42-p84j-f58p",
  "modified": "2023-01-23T20:47:11Z",
  "published": "2018-03-21T11:56:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3740"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rgrove/sanitize/issues/176"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rgrove/sanitize/commit/93feeb38e21864146bb29191792b971dbe1ec62e"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rgrove/sanitize"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sanitize/CVE-2018-3740.yml"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4358"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sanitize vulnerable to Improper Input Validation and Cross-site Scripting"
}

gsd-2018-3740

Vulnerability from gsd

Modified

2018-03-19 00:00

Details

When Sanitize gem is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.

Aliases

CVE-2018-3740

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-3740",
    "description": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.",
    "id": "GSD-2018-3740",
    "references": [
      "https://www.suse.com/security/cve/CVE-2018-3740.html",
      "https://www.debian.org/security/2018/dsa-4358",
      "https://security.archlinux.org/CVE-2018-3740"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "sanitize",
            "purl": "pkg:gem/sanitize"
          }
        }
      ],
      "aliases": [
        "CVE-2018-3740",
        "GHSA-7f42-p84j-f58p"
      ],
      "details": "When Sanitize gem is used in combination with libxml2 \u003e= 2.9.2,\na specially crafted HTML fragment can cause libxml2 to generate\nimproperly escaped output, allowing non-whitelisted attributes to be\nused on whitelisted elements.\n\nThis can allow HTML and JavaScript injection, which could result in XSS\nif Sanitize\u0027s output is served to browsers.\n",
      "id": "GSD-2018-3740",
      "modified": "2018-03-19T00:00:00.000Z",
      "published": "2018-03-19T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/rgrove/sanitize/issues/176"
        },
        {
          "type": "WEB",
          "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "HTML injection/XSS in Sanitize"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "support@hackerone.com",
        "ID": "CVE-2018-3740",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "sanitize (ruby gem)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 4.6.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Ryan Grove"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) (CWE-79)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "DSA-4358",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2018/dsa-4358"
          },
          {
            "name": "https://github.com/rgrove/sanitize/issues/176",
            "refsource": "CONFIRM",
            "url": "https://github.com/rgrove/sanitize/issues/176"
          },
          {
            "name": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/",
            "refsource": "CONFIRM",
            "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"
          },
          {
            "name": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
            "refsource": "CONFIRM",
            "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2018-3740",
      "cvss_v3": 7.5,
      "date": "2018-03-19",
      "description": "When Sanitize gem is used in combination with libxml2 \u003e= 2.9.2,\na specially crafted HTML fragment can cause libxml2 to generate\nimproperly escaped output, allowing non-whitelisted attributes to be\nused on whitelisted elements.\n\nThis can allow HTML and JavaScript injection, which could result in XSS\nif Sanitize\u0027s output is served to browsers.\n",
      "gem": "sanitize",
      "ghsa": "7f42-p84j-f58p",
      "patched_versions": [
        "~\u003e 2.1.1",
        "\u003e= 4.6.3"
      ],
      "related": {
        "url": [
          "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
        ]
      },
      "title": "HTML injection/XSS in Sanitize",
      "unaffected_versions": [
        "\u003c 1.1.0"
      ],
      "url": "https://github.com/rgrove/sanitize/issues/176"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=1.1.0 \u003c4.6.3",
          "affected_versions": "All versions starting from 1.1.0 before 4.6.3",
          "credit": "Shopify Application Security Team",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-20",
            "CWE-937"
          ],
          "date": "2018-12-28",
          "description": "When sanitize is used in combination with libxml2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing attributes that are not specified in the allowlist to be used. This can allow HTML and JavaScript injection, which could result in XSS if the output is served to browsers.",
          "fixed_versions": [
            "4.6.3"
          ],
          "identifier": "CVE-2018-3740",
          "identifiers": [
            "CVE-2018-3740"
          ],
          "not_impacted": "Prior to 1.1.0 or using libxml2 prior to 2.9.2",
          "package_slug": "gem/sanitize",
          "pubdate": "2018-03-30",
          "solution": "Upgrade to 4.6.3",
          "title": "HTML injection/XSS",
          "urls": [
            "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
            "https://github.com/rgrove/sanitize/issues/176"
          ],
          "uuid": "a6c2ee2e-6663-42cb-b49a-431f4ba14a01"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.6.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assignments@hackerone.com",
          "ID": "CVE-2018-3740"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/rgrove/sanitize/issues/176",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://github.com/rgrove/sanitize/issues/176"
            },
            {
              "name": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
            },
            {
              "name": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"
            },
            {
              "name": "DSA-4358",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "https://www.debian.org/security/2018/dsa-4358"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2018-12-28T16:29Z",
      "publishedDate": "2018-03-30T19:29Z"
    }
  }
}

cve-2018-3740

Vulnerability from cvelistv5

Published

2018-03-30 19:00

Modified

2024-08-05 04:50

Severity ?

Summary

A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.

References

▼	URL	Tags
	https://www.debian.org/security/2018/dsa-4358	vendor-advisory, x_refsource_DEBIAN
	https://github.com/rgrove/sanitize/issues/176	x_refsource_CONFIRM
	https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/	x_refsource_CONFIRM
	https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

Ryan Grove

sanitize (ruby gem)

Version: < 4.6.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:50:30.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4358",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4358"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rgrove/sanitize/issues/176"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sanitize (ruby gem)",
          "vendor": "Ryan Grove",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.3"
            }
          ]
        }
      ],
      "datePublic": "2018-03-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) (CWE-79)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-28T10:57:01",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "name": "DSA-4358",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4358"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rgrove/sanitize/issues/176"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2018-3740",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "sanitize (ruby gem)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 4.6.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Ryan Grove"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) (CWE-79)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4358",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4358"
            },
            {
              "name": "https://github.com/rgrove/sanitize/issues/176",
              "refsource": "CONFIRM",
              "url": "https://github.com/rgrove/sanitize/issues/176"
            },
            {
              "name": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/",
              "refsource": "CONFIRM",
              "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"
            },
            {
              "name": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
              "refsource": "CONFIRM",
              "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2018-3740",
    "datePublished": "2018-03-30T19:00:00",
    "dateReserved": "2017-12-28T00:00:00",
    "dateUpdated": "2024-08-05T04:50:30.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

GHSA-7f42-p84j-f58p

Vulnerability from github

gsd-2018-3740

Vulnerability from gsd

cve-2018-3740

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature