GHSA-mf2j-8f84-cc9q: Loofah: Regular expression denial of service in the SVG local-reference check
Summary
Loofah's HTML5 sanitizer restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s[^#\s]./m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.
Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.
Impact
An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or xlink:href is a long run of whitespace.
The default safelist allows the elements in SVGALLOWLOCALHREF, so no configuration change is required.
Mitigation
Upgrade to Loofah >= 2.25.3. Applications that cannot upgrade should run Ruby 3.2 or later, which matches the pattern in linear time.
Credit
Reported by scyoon through the Rails HackerOne program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Rubyto a version that resolves this vulnerability.Fixed in 3.2
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Applications using Loofah’s HTML5 sanitizer on Ruby 3.1 or earlier are exposed when they sanitize attacker-supplied HTML. No safelist customization is needed because the default safelist permits the relevant SVG elements.
What does an attacker need to submit to trigger the issue?
The attacker needs to control HTML that is passed to the sanitizer. Affected input contains an SVG reference element with an href or xlink:href value made up of a long run of whitespace.
What can be done if Loofah cannot be upgraded immediately?
Run the application on Ruby 3.2 or later. Ruby 3.2 uses linear-time regular-expression matching for this pattern, preventing the quadratic CPU consumption described.
How can I determine whether this affects my application?
Check whether the application sanitizes untrusted HTML with Loofah’s HTML5 sanitizer and runs on Ruby 3.1 or earlier. Loofah versions before 2.25.3 should be upgraded; version 2.25.3 or later is the stated mitigation.