GHSA-m3x9-938q-5767: Loofah: CSS url() sanitization bypass via escaped parentheses
Summary
Loofah::HTML5::Scrub.scrubcss rejected any property whose top-level Crass tokens included a :url or :badurl, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrubcss rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — url\28 …\29 — hid the url token from the checks, and the rebuilt value was re-parsed into a live url() that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place.
Impact
A sanitized style attribute could make a viewer's browser issue a request to an attacker-chosen URL. list-style fetches on render with no interaction, cursor on hover. That leaks the viewer's IP address, user agent and access timing, and can reach hosts routable only from the viewer's network. No script survives sanitization and the attacker cannot read the response, so the request itself is the whole impact.
Applications that sanitize user-supplied HTML with Loofah's default allowlist and display it to other people are affected.
Mitigation
Upgrade to Loofah >= 2.25.3.
Credit
Reported by NotAFlightRisk through GitHub's private vulnerability reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Loofahto a version that resolves this vulnerability.Fixed in 2.25.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications that sanitize user-supplied HTML with Loofah's default allowlist and display the resulting content to other people are affected.
What does an attacker need to exploit this?
The attacker needs to supply HTML containing a crafted style attribute that is sanitized and later rendered by another person's browser. Escaped CSS syntax can cause a URL-bearing CSS value to become active after sanitization.
What is the practical impact on viewers?
A viewer's browser can request an attacker-chosen URL, leaking the viewer's IP address, user agent, and access timing. The request may also reach hosts routable only from the viewer's network; list-style can fetch on render, while cursor can fetch on hover.
Can the attacker execute script or read the fetched response?
No script survives sanitization, and the attacker cannot read the response. The network request itself is the impact.