Internet Bug Bounty · Report #2931688

ActionView sanitize helper bypass with 'style' and 'svg' tags

Validstatus

mediumseverity

25upvotes

6 Feb 2025disclosed

Summary

There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.

Versions affected: 1.6.0 Not affected: < 1.6.0 Fixed versions: 1.6.1

Advisory: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr

How it was found

Rails-html-sanitizer, which Rails AtionView also uses fails to sanitize input when svg and style OR math and style are allowed An example would be as follows;

<%= sanitize @comment.body, tags: ["math", "style"] %>
<%# or %>
<%= sanitize @comment.body, tags: ["svg", "style"] %>

You could see other patterns/places where this is used in the security advisory. View #2503220 for details.

Impact

Sanitizer bypass that leads to XSS on applications built with it. It also affects applications using Rails Action View's sanitize helper: https://api.rubyonrails.org/v7.2/classes/ActionView/Helpers/SanitizeHelper.html

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original