CVE-2024-53987
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in rails-html-sanitizer 1.6.0 when used with Rails >= 7.1.0. It allows attackers to inject malicious content if HTML5 sanitization is enabled and developers have overridden allowed tags to include 'style' but exclude 'svg' or 'math'. Applications using these specific configurations are affected.
💻 Affected Systems
- rails-html-sanitizer
- Ruby on Rails
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, performing actions as the user, or defacing websites.
Likely Case
Limited XSS attacks affecting users who view malicious content, potentially leading to session hijacking or credential theft.
If Mitigated
No impact if proper input validation and output encoding are already implemented, or if the vulnerable configuration isn't used.
🎯 Exploit Status
Exploitation requires specific application configuration and user interaction to view malicious content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.1
Vendor Advisory: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
Restart Required: Yes
Instructions:
1. Update Gemfile to specify 'rails-html-sanitizer', '>= 1.6.1'. 2. Run 'bundle update rails-html-sanitizer'. 3. Restart your Rails application server.
🔧 Temporary Workarounds
Disable HTML5 sanitization
allSwitch to using the older HTML4 sanitizer instead of HTML5 sanitizer
In Rails configuration: config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer
Modify allowed tags configuration
allEnsure 'svg' and 'math' elements are allowed if 'style' element is allowed
Update sanitizer configuration to include both 'style' and 'svg'/'math' in allowed tags
🧯 If You Can't Patch
- Implement additional output encoding for user-controlled content
- Review and audit all custom sanitizer configurations to ensure they don't match the vulnerable pattern
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock for 'rails-html-sanitizer (1.6.0)' and ensure Rails version is >= 7.1.0. Also verify if custom sanitizer configurations match the vulnerable pattern.Check Version:
bundle show rails-html-sanitizerVerify Fix Applied:
Verify Gemfile.lock shows 'rails-html-sanitizer (1.6.1)' or higher📡 Detection & Monitoring
Log Indicators:
- Unusual HTML content containing style elements with suspicious attributes
- Multiple requests with encoded payloads
Network Indicators:
- HTTP requests containing suspicious HTML fragments with style attributes
SIEM Query:
source="rails_app" AND (message="*style*" OR message="*sanitize*")