oss-security - CVE request: ruby on rails XSS Weakness in strip

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091127140347.GB22978@suse.de>
Date: Fri, 27 Nov 2009 15:03:47 +0100
From: Thomas Biege <thomas@...e.de>
To: OSS-Security Mailinglist <oss-security@...ts.openwall.com>
Subject: CVE request: ruby on rails XSS Weakness in strip_tags

http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1

Michael Koziarski   	
Profil anzeigen   �bersetzen in die Sprache: Deutsch �bersetzt (Original anzeigen)
	 Weitere Optionen 27 Nov., 02:44
Von: Michael Koziarski <mich...@...iarski.com>
Datum: Fri, 27 Nov 2009 13:44:06 +1300
Lokal: Fr. 27 Nov. 2009 02:44
Betreff: XSS Weakness in strip_tags
Antworten | Antwort an Autor | Weiterleiten | Drucken | Einzelne Nachricht | Original anzeigen | Diese Nachricht melden | Nachrichten dieses Autors suchen

There is a weakness in the strip_tags function in ruby on rails.  Due to
a bug in the parsing code inside HTML::Tokenizer regarding non-printable
ascii characters, an attacker can include values which certain browsers
will then evaluate.

Versions Affected:  All versions prior to 2.3.4 or 2.2.s
Not affected:       Applications which do not use strip_tags
Fixed Versions:     2.3.5

Impact
------

Applications relying on strip_tags for XSS protection may be vulnerable
to attacks on Internet Explorer users.

Releases
--------

The 2.3.5 releases is available at the normal locations now.

Workarounds
-----------

Users using strip_tags can pass the resulting output to the regular
escaping functionality:

  <%= h(strip_tag(...)) %>

Patches
-------

To aid users who aren't able to upgrade immediately we have provided
patches for the two supported release series.  They are in git-am format
and consist of a single changeset updating the parser and providing an
additional unit test.

* 2-2-strip_tags.patch - Patch for 2.2 series
* 2-3-strip_tags.patch - Patch for 2.3 series

Please note that only the  2.2.x and 2.3.x series are supported at
present.  Users of earlier unsupported releases are advised to upgrade
at their earliest convenience.

Credits
-------
Thanks to Gabe da Silveira for reporting the vulnerability to us and
providing the fix.

-- 
Cheers,

----- End forwarded message -----

-- 
Bye,
     Thomas
-- 
 Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
-- 
  Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
                            -- Marie von Ebner-Eschenbach

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.