CVE-2022-23518: Improper neutralization of data URIs allows XSS in rails-html-sanitizer

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2022-23518.

Q: What is the severity level of CVE-2022-23518?

The severity level of CVE-2022-23518 is Medium Severity 6.1.

Q: Which software is affected by CVE-2022-23518?

The software affected by CVE-2022-23518 includes rails-html-sanitizer versions >= 1.0.3 and < 1.4.4, as well as Loofah >= 2.1.0.

Published Dec 13, 2022

Updated

Summary

rails-html-sanitizer >= 1.0.3, < 1.4.4 is vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0.

Mitigation

Upgrade to rails-html-sanitizer >= 1.4.4.

Severity

The maintainers have evaluated this as Medium Severity 6.1.

References

- CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9) - SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg - https://github.com/rails/rails-html-sanitizer/issues/135 - https://hackerone.com/reports/1694173

Credit

This vulnerability was independently reported by Maciej Piechota (@haqpl) and Mrinmoy Das (@goromlagche).

Other sources

A Cross-site scripting vulnerability was found in rails-html-sanitizer. When used in combination with Loofah since version 2.1.0, improper neutralization of data URIs may allow Cross-site scripting.

Rails-html-sanitizer in versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs, when used in combination with Loofah >= 2.1.0.

— Red Hat

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.

Affected Software

8 affected componentsFixes available

rubygems/rails-html-sanitizer>=1.0.3<1.4.4

1.4.4

redhat/rubygem-rails-html-sanitizer<0:1.4.4-1.el8

0:1.4.4-1.el8

redhat/rubygem-rails-html-sanitizer<1.4.4

1.4.4

Loofah Project Loofah Ruby<=2.1.0

Rails Html Sanitizer Project Rails Html Sanitizer Ruby>=1.0.3<1.4.4

rubyonrails Rails Html Sanitizers Rails>=1.0.3<1.4.4

Debian Debian Linux=10.0

Loofah Project Loofah Ruby>=2.1.0<2.19.1

Event History

Dec 13, 2022

CVE Published

12:00 AM

Advisory Published

05:45 PM

Dec 14, 2022

CVE Published

via MITRE·04:22 PM

Data Sourced

via MITRE·04:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

RHSA-2023:2097

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2022-23518.

What is the severity level of CVE-2022-23518?

The severity level of CVE-2022-23518 is Medium Severity 6.1.

Which software is affected by CVE-2022-23518?

The software affected by CVE-2022-23518 includes rails-html-sanitizer versions >= 1.0.3 and < 1.4.4, as well as Loofah >= 2.1.0.

How can I mitigate the vulnerability?

To mitigate the vulnerability, upgrade to rails-html-sanitizer version >= 1.4.4.

Where can I find more information about CVE-2022-23518?

You can find more information about CVE-2022-23518 at the following references: [CVE](https://www.cve.org/CVERecord?id=CVE-2022-23518), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-23518), [GitHub issue](https://github.com/rails/rails-html-sanitizer/issues/135), [GitHub advisory](https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2153701), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2023:2097).