GHSA-G7XQ-XV8C-H98C

Vulnerability from github – Published: 2024-04-17 00:20 – Updated: 2024-04-19 21:44
VLAI
Summary
Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
Details

Summary

There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.

Our filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an <a> tag could be bypassed with tab \t or newline \n characters between the characters of the protocol, e.g. java\tscript:.

Impact

If you render an <a> tag with an href attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user.

a(href: user_profile) { "Profile" }

Mitigation

The best way to mitigate this vulnerability is to update to one of the following versions:

Workarounds

Configuring a Content Security Policy that does not allow unsafe-inline would effectively prevent this vulnerability from being exploited.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "phlex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "fixed": "1.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.0"
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "phlex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.0"
            },
            {
              "fixed": "1.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "phlex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.8.0"
            },
            {
              "fixed": "1.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "phlex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "phlex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "phlex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "phlex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32463"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-87"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-17T00:20:23Z",
    "nvd_published_at": "2024-04-17T16:15:09Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThere is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.\n\nOur filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `\u003ca\u003e` tag could be bypassed with tab `\\t` or newline `\\n` characters between the characters of the protocol, e.g. `java\\tscript:`.\n\n### Impact\n\nIf you render an `\u003ca\u003e` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user.\n\n```ruby\na(href: user_profile) { \"Profile\" }\n```\n\n### Mitigation\n\nThe best way to mitigate this vulnerability is to update to one of the following versions:\n\n- [1.10.1](https://rubygems.org/gems/phlex/versions/1.10.1)\n- [1.9.2](https://rubygems.org/gems/phlex/versions/1.9.2)\n- [1.8.3](https://rubygems.org/gems/phlex/versions/1.8.3)\n- [1.7.2](https://rubygems.org/gems/phlex/versions/1.7.2)\n- [1.6.3](https://rubygems.org/gems/phlex/versions/1.6.3)\n- [1.5.3](https://rubygems.org/gems/phlex/versions/1.5.3)\n- [1.4.2](https://rubygems.org/gems/phlex/versions/1.4.2)\n\n### Workarounds\nConfiguring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited.",
  "id": "GHSA-g7xq-xv8c-h98c",
  "modified": "2024-04-19T21:44:03Z",
  "published": "2024-04-17T00:20:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32463"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"
    },
    {
      "type": "WEB",
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"
    },
    {
      "type": "WEB",
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phlex-ruby/phlex"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32463.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `\u003ca\u003e` tags"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.