Date: Thu, 11 Aug 2016 10:52:10 -0700 From: Aaron Patterson <tenderlove@...y-lang.org> To: security@...e.de, rubyonrails-security@...glegroups.com, oss-security@...ts.openwall.com, ruby-security-ann@...glegroups.com Subject: [CVE-2016-6316] Possible XSS Vulnerability in Action View # Possible XSS Vulnerability in Action View There is a possible XSS vulnerability in Action View. Text declared as "HTML safe" will not have quotes escaped when used as attribute values in tag helpers. This vulnerability has been assigned the CVE identifier CVE-2016-6316. Versions Affected: >= 3.0.0. Not affected: < 3.0.0 Fixed Versions: 188.8.131.52, 184.108.40.206, 220.127.116.11 Impact ------ Text declared as "HTML safe" when passed as an attribute value to a tag helper will not have quotes escaped which can lead to an XSS attack. Impacted code looks something like this: ``` content_tag(:div, "hi", title: user_input.html_safe) ``` Some helpers like the `sanitize` helper will automatically mark strings as "HTML safe", so impacted code could also look something like this: ``` content_tag(:div, "hi", title: sanitize(user_input)) ``` All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The FIXED releases are available at the normal locations. Workarounds ----------- You can work around this issue by either *not* marking arbitrary user input as safe, or by manually escaping quotes like this: ``` def escape_quotes(value) value.gsub(/"/, '"'.freeze) end content_tag(:div, "hi", title: escape_quotes(sanitize(user_input))) ``` Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 3-2-attribute-xss.patch - Patch for 3.2 series * 4-2-attribute-xss.patch - Patch for 4.2 series * 5-0-attribute-xss.patch - Patch for 5.0 series Please note that only the 5.0.x and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. Credits ------- Thanks to Andrew Carpenter of Critical Juncture for reporting this issue and sending a patch to fix it! -- Aaron Patterson http://tenderlovemaking.com/ View attachment "3-2-attribute-xss.patch" of type "text/plain" (3218 bytes) View attachment "4-2-attribute-xss.patch" of type "text/plain" (2244 bytes) View attachment "5-0-attribute-xss.patch" of type "text/plain" (2591 bytes) Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.