gsd-2018-3740
Vulnerability from gsd
Modified
2018-03-19 00:00
Details
When Sanitize gem is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.
Aliases
Aliases
CVE-2018-3740


To clipboard 

{
  "GSD": {
    "alias": "CVE-2018-3740",
    "description": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.",
    "id": "GSD-2018-3740",
    "references": [
      "https://www.suse.com/security/cve/CVE-2018-3740.html",
      "https://www.debian.org/security/2018/dsa-4358",
      "https://security.archlinux.org/CVE-2018-3740"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "sanitize",
            "purl": "pkg:gem/sanitize"
          }
        }
      ],
      "aliases": [
        "CVE-2018-3740",
        "GHSA-7f42-p84j-f58p"
      ],
      "details": "When Sanitize gem is used in combination with libxml2 \u003e= 2.9.2,\na specially crafted HTML fragment can cause libxml2 to generate\nimproperly escaped output, allowing non-whitelisted attributes to be\nused on whitelisted elements.\n\nThis can allow HTML and JavaScript injection, which could result in XSS\nif Sanitize\u0027s output is served to browsers.\n",
      "id": "GSD-2018-3740",
      "modified": "2018-03-19T00:00:00.000Z",
      "published": "2018-03-19T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/rgrove/sanitize/issues/176"
        },
        {
          "type": "WEB",
          "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "HTML injection/XSS in Sanitize"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "support@hackerone.com",
        "ID": "CVE-2018-3740",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "sanitize (ruby gem)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 4.6.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Ryan Grove"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) (CWE-79)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "DSA-4358",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2018/dsa-4358"
          },
          {
            "name": "https://github.com/rgrove/sanitize/issues/176",
            "refsource": "CONFIRM",
            "url": "https://github.com/rgrove/sanitize/issues/176"
          },
          {
            "name": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/",
            "refsource": "CONFIRM",
            "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"
          },
          {
            "name": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
            "refsource": "CONFIRM",
            "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2018-3740",
      "cvss_v3": 7.5,
      "date": "2018-03-19",
      "description": "When Sanitize gem is used in combination with libxml2 \u003e= 2.9.2,\na specially crafted HTML fragment can cause libxml2 to generate\nimproperly escaped output, allowing non-whitelisted attributes to be\nused on whitelisted elements.\n\nThis can allow HTML and JavaScript injection, which could result in XSS\nif Sanitize\u0027s output is served to browsers.\n",
      "gem": "sanitize",
      "ghsa": "7f42-p84j-f58p",
      "patched_versions": [
        "~\u003e 2.1.1",
        "\u003e= 4.6.3"
      ],
      "related": {
        "url": [
          "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
        ]
      },
      "title": "HTML injection/XSS in Sanitize",
      "unaffected_versions": [
        "\u003c 1.1.0"
      ],
      "url": "https://github.com/rgrove/sanitize/issues/176"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=1.1.0 \u003c4.6.3",
          "affected_versions": "All versions starting from 1.1.0 before 4.6.3",
          "credit": "Shopify Application Security Team",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-20",
            "CWE-937"
          ],
          "date": "2018-12-28",
          "description": "When sanitize is used in combination with libxml2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing attributes that are not specified in the allowlist to be used. This can allow HTML and JavaScript injection, which could result in XSS if the output is served to browsers.",
          "fixed_versions": [
            "4.6.3"
          ],
          "identifier": "CVE-2018-3740",
          "identifiers": [
            "CVE-2018-3740"
          ],
          "not_impacted": "Prior to 1.1.0 or using libxml2 prior to 2.9.2",
          "package_slug": "gem/sanitize",
          "pubdate": "2018-03-30",
          "solution": "Upgrade to 4.6.3",
          "title": "HTML injection/XSS",
          "urls": [
            "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
            "https://github.com/rgrove/sanitize/issues/176"
          ],
          "uuid": "a6c2ee2e-6663-42cb-b49a-431f4ba14a01"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.6.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assignments@hackerone.com",
          "ID": "CVE-2018-3740"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/rgrove/sanitize/issues/176",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://github.com/rgrove/sanitize/issues/176"
            },
            {
              "name": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"
            },
            {
              "name": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"
            },
            {
              "name": "DSA-4358",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "https://www.debian.org/security/2018/dsa-4358"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2018-12-28T16:29Z",
      "publishedDate": "2018-03-30T19:29Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.