PT-2018-2635 · Ruby · Sanitize

Published 2018-03-21 · Updated 2018-12-28 · CVE-2018-3740

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sanitize gem for Ruby versions prior to 4.6.3

Description The issue is related to errors in input data checking in the Sanitize library for Ruby. It can be exploited by a remote attacker to bypass restrictions on the use of HTML attributes, allowing non-whitelisted attributes to be used on whitelisted HTML elements. This can lead to HTML and JavaScript injection, potentially resulting in cross-site scripting (XSS) if the output is served to browsers.

Recommendations For Sanitize gem for Ruby versions prior to 4.6.3, update to version 4.6.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Sanitize gem until a patch is available.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

BDU:2019-01252

CVE-2018-3740

DSA-4358-1

GHSA-7F42-P84J-F58P

Affected Products

Sanitize

References · 21

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sanitize/CVE-2018-3740.yml · Exploit
• https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e · Patch
• https://bdu.fstec.ru/vul/2019-01252 · Security Note
• https://osv.dev/vulnerability/DSA-4358-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7f42-p84j-f58p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3740 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3740 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-3740 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3740 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-3740 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3740 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-3740 · Vendor Advisory
• https://debian.org/security/2018/dsa-4358 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4358-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3740 · Security Note