Internet Bug Bounty · Report #2931691
ActionView sanitize helper bypass with noscript
Summary
Summary
There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0.
Versions affected: 1.6.0 Not affected: < 1.6.0 Fixed versions: 1.6.1
Advisory: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rxv5-gxqc-xx8g
How it was found
Rails-html-sanitizer, which Rails AtionView also uses fails to sanitize input when noscript are allowed.
An example would be as follows;
<%= sanitize '<noscript><p id="</noscript><script>alert(1)</script>"></noscript>' %>
You could see other patterns/places where this is used in the security advisory. View #250964 for details.
Impact
Sanitizer bypass that leads to XSS on applications built with it. It also affects applications using Rails Action View's sanitize helper: https://api.rubyonrails.org/v7.2/classes/ActionView/Helpers/SanitizeHelper.html