In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site     scripting vulnerability. When HTML is sanitized using Sanitize's relaxed config, or a custom config that     allows certain elements, some content in a math or svg element may not be sanitized correctly even if math     and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's     relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math,     noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an     attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site     scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in     5.2.1. (CVE-2020-4054)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4543-1 advisory.

    Micha Bentkowski discovered that Sanitize did not properly sanitize some math or svg HTML under certain     circumstances. A remote attacker could potentially exploit this to conduct cross-site scripting (XSS)     attacks. (CVE-2020-4054)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Michal Bentkowski discovered that ruby-sanitize, a whitelist-based HTML sanitizer, is prone to a HTML sanitization bypass vulnerability when using the 'relaxed' or a custom config allowing certain elements.
Content in a <math> or <svg> element may not be sanitized correctly even if math and svg are not in the allowlist.

ID	Name	Product	Family	Severity
257074	Linux Distros Unpatched Vulnerability : CVE-2020-4054	Nessus	Misc.	high
140803	Ubuntu 20.04 LTS : Sanitize vulnerability (USN-4543-1)	Nessus	Ubuntu Local Security Checks	high
138650	Debian DSA-4730-1 : ruby-sanitize - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-4054

high

Tenable Plugins

high

high

high