A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to
    be used on a whitelisted HTML element. (CVE-2018-3740)

The Shopify Application Security Team discovered that ruby-sanitize, a whitelist-based HTML sanitizer, is prone to a HTML injection vulnerability. A specially crafted HTML fragment can cause to allow nonwhitelisted attributes to be used on a whitelisted HTML element.

Gitlab reports :

Wiki XSS

Sanitize gem updates

XSS in url_for(params)

Content injection via username

Activity feed publicly displaying internal project names

Persistent XSS in charts

Sanitize release :

Fixed an HTML injection vulnerability that could allow XSS.

When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements.

Sanitize now performs additional escaping on affected attributes to prevent this.

ID	Name	Product	Family	Severity
422575	SCA: security update for sanitize (GHSA-7f42-p84j-f58p)	Tenable Cloud Security	SCA Checks	high
422575	SCA: security update for sanitize (GHSA-7f42-p84j-f58p)	Tenable Self-Hosted Container Security	SCA Checks	high
119891	Debian DSA-4358-1 : ruby-sanitize - security update	Nessus	Debian Local Security Checks	high
110699	FreeBSD : Gitlab -- multiple vulnerabilities (b950a83b-789e-11e8-8545-d8cb8abf62dd)	Nessus	FreeBSD Local Security Checks	high
108524	FreeBSD : Sanitize -- XSS vulnerability (39a30e0a-0c34-431b-9dce-b87cab02412a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-3740

high

Tenable Plugins

high

high

high

high

high