gsd-2018-3740
Vulnerability from gsd
Modified
2018-03-19 00:00
Details
When Sanitize gem is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.
Aliases
Aliases
CVE-2018-3740


To clipboard 

{
   GSD: {
      alias: "CVE-2018-3740",
      description: "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.",
      id: "GSD-2018-3740",
      references: [
         "https://www.suse.com/security/cve/CVE-2018-3740.html",
         "https://www.debian.org/security/2018/dsa-4358",
         "https://security.archlinux.org/CVE-2018-3740",
      ],
   },
   gsd: {
      metadata: {
         exploitCode: "unknown",
         remediation: "unknown",
         reportConfidence: "confirmed",
         type: "vulnerability",
      },
      osvSchema: {
         affected: [
            {
               package: {
                  ecosystem: "RubyGems",
                  name: "sanitize",
                  purl: "pkg:gem/sanitize",
               },
            },
         ],
         aliases: [
            "CVE-2018-3740",
            "GHSA-7f42-p84j-f58p",
         ],
         details: "When Sanitize gem is used in combination with libxml2 >= 2.9.2,\na specially crafted HTML fragment can cause libxml2 to generate\nimproperly escaped output, allowing non-whitelisted attributes to be\nused on whitelisted elements.\n\nThis can allow HTML and JavaScript injection, which could result in XSS\nif Sanitize's output is served to browsers.\n",
         id: "GSD-2018-3740",
         modified: "2018-03-19T00:00:00.000Z",
         published: "2018-03-19T00:00:00.000Z",
         references: [
            {
               type: "WEB",
               url: "https://github.com/rgrove/sanitize/issues/176",
            },
            {
               type: "WEB",
               url: "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
            },
         ],
         schema_version: "1.4.0",
         severity: [
            {
               score: 7.5,
               type: "CVSS_V3",
            },
         ],
         summary: "HTML injection/XSS in Sanitize",
      },
   },
   namespaces: {
      "cve.org": {
         CVE_data_meta: {
            ASSIGNER: "support@hackerone.com",
            ID: "CVE-2018-3740",
            STATE: "PUBLIC",
         },
         affects: {
            vendor: {
               vendor_data: [
                  {
                     product: {
                        product_data: [
                           {
                              product_name: "sanitize (ruby gem)",
                              version: {
                                 version_data: [
                                    {
                                       version_value: "< 4.6.3",
                                    },
                                 ],
                              },
                           },
                        ],
                     },
                     vendor_name: "Ryan Grove",
                  },
               ],
            },
         },
         data_format: "MITRE",
         data_type: "CVE",
         data_version: "4.0",
         description: {
            description_data: [
               {
                  lang: "eng",
                  value: "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.",
               },
            ],
         },
         problemtype: {
            problemtype_data: [
               {
                  description: [
                     {
                        lang: "eng",
                        value: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)",
                     },
                  ],
               },
            ],
         },
         references: {
            reference_data: [
               {
                  name: "DSA-4358",
                  refsource: "DEBIAN",
                  url: "https://www.debian.org/security/2018/dsa-4358",
               },
               {
                  name: "https://github.com/rgrove/sanitize/issues/176",
                  refsource: "CONFIRM",
                  url: "https://github.com/rgrove/sanitize/issues/176",
               },
               {
                  name: "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/",
                  refsource: "CONFIRM",
                  url: "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/",
               },
               {
                  name: "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
                  refsource: "CONFIRM",
                  url: "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
               },
            ],
         },
      },
      "github.com/rubysec/ruby-advisory-db": {
         cve: "2018-3740",
         cvss_v3: 7.5,
         date: "2018-03-19",
         description: "When Sanitize gem is used in combination with libxml2 >= 2.9.2,\na specially crafted HTML fragment can cause libxml2 to generate\nimproperly escaped output, allowing non-whitelisted attributes to be\nused on whitelisted elements.\n\nThis can allow HTML and JavaScript injection, which could result in XSS\nif Sanitize's output is served to browsers.\n",
         gem: "sanitize",
         ghsa: "7f42-p84j-f58p",
         patched_versions: [
            "~> 2.1.1",
            ">= 4.6.3",
         ],
         related: {
            url: [
               "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
            ],
         },
         title: "HTML injection/XSS in Sanitize",
         unaffected_versions: [
            "< 1.1.0",
         ],
         url: "https://github.com/rgrove/sanitize/issues/176",
      },
      "gitlab.com": {
         advisories: [
            {
               affected_range: ">=1.1.0 <4.6.3",
               affected_versions: "All versions starting from 1.1.0 before 4.6.3",
               credit: "Shopify Application Security Team",
               cvss_v2: "AV:N/AC:L/Au:N/C:N/I:P/A:N",
               cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
               cwe_ids: [
                  "CWE-1035",
                  "CWE-20",
                  "CWE-937",
               ],
               date: "2018-12-28",
               description: "When sanitize is used in combination with libxml2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing attributes that are not specified in the allowlist to be used. This can allow HTML and JavaScript injection, which could result in XSS if the output is served to browsers.",
               fixed_versions: [
                  "4.6.3",
               ],
               identifier: "CVE-2018-3740",
               identifiers: [
                  "CVE-2018-3740",
               ],
               not_impacted: "Prior to 1.1.0 or using libxml2 prior to 2.9.2",
               package_slug: "gem/sanitize",
               pubdate: "2018-03-30",
               solution: "Upgrade to 4.6.3",
               title: "HTML injection/XSS",
               urls: [
                  "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
                  "https://github.com/rgrove/sanitize/issues/176",
               ],
               uuid: "a6c2ee2e-6663-42cb-b49a-431f4ba14a01",
            },
         ],
      },
      "nvd.nist.gov": {
         configurations: {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:*",
                        cpe_name: [],
                        versionEndIncluding: "4.6.0",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
         cve: {
            CVE_data_meta: {
               ASSIGNER: "cve-assignments@hackerone.com",
               ID: "CVE-2018-3740",
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "en",
                     value: "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "en",
                           value: "CWE-20",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/rgrove/sanitize/issues/176",
                     refsource: "CONFIRM",
                     tags: [
                        "Issue Tracking",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/rgrove/sanitize/issues/176",
                  },
                  {
                     name: "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
                     refsource: "CONFIRM",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e",
                  },
                  {
                     name: "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/",
                     refsource: "CONFIRM",
                     tags: [],
                     url: "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/",
                  },
                  {
                     name: "DSA-4358",
                     refsource: "DEBIAN",
                     tags: [],
                     url: "https://www.debian.org/security/2018/dsa-4358",
                  },
               ],
            },
         },
         impact: {
            baseMetricV2: {
               cvssV2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                  version: "2.0",
               },
               exploitabilityScore: 10,
               impactScore: 2.9,
               obtainAllPrivilege: false,
               obtainOtherPrivilege: false,
               obtainUserPrivilege: false,
               severity: "MEDIUM",
               userInteractionRequired: false,
            },
            baseMetricV3: {
               cvssV3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.0",
               },
               exploitabilityScore: 3.9,
               impactScore: 3.6,
            },
         },
         lastModifiedDate: "2018-12-28T16:29Z",
         publishedDate: "2018-03-30T19:29Z",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.