CVE-2019-15587 - Loofah XSS Vulnerability #171

flavorjones · 2019-10-09T19:30:48Z

CVE-2019-15587 - Loofah XSS Vulnerability

This issue has been created for public disclosure of an XSS vulnerability that was responsibly reported by https://hackerone.com/vxhex

I'd like to thank HackerOne for providing a secure, responsible mechanism for reporting, and for providing their fantastic service to the Loofah maintainers.

Severity

Loofah maintainers have evaluated this as Medium (CVSS3 6.4).

Description

In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

Affected Versions

Loofah <= v2.3.0

Mitigation

Upgrade to Loofah v2.3.1 or later.

References

HackerOne report (private)

History of this public disclosure

2019-10-09: disclosure created, all information is embargoed
2019-10-22: embargo ends, full information made available
2019-10-22: corrected "affected versions" to read Loofah <= v2.3.0


        mitigate XSS vulnerability in SVG animate attributes

this addresses CVE-2019-15587 see #171 for more information #171

flavorjones · 2019-10-22T13:09:41Z

This issue has been updated with full unembargoed information.

flavorjones · 2019-10-22T13:17:24Z

v2.3.1 is released which addresses this vulnerability.

graaff · 2019-10-22T13:21:01Z

The "affected versions" section contains "< 2.3.0", but reading the rest of the report I assume this should be < 2.3.1 (that is, including 2.3.0)?

flavorjones · 2019-10-22T13:22:57Z

@graaff You're right, I've corrected it to Loofah <= v2.3.0


        www/ruby-loofah: update to 2.3.1

@danfstucky

## 2.3.1 / 2019-10-22 ### Security Address CVE-2019-15587: Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. This CVE's public notice is at flavorjones/loofah#171 ## 2.3.0 / unreleased ### Features * Expand set of allowed protocols to include `tel:` and `line:`. [#104, #147] * Expand set of allowed CSS functions. [related to #122] * Allow greater precision in shorthand CSS values. [#149] (Thanks, @danfstucky!) * Allow CSS property `list-style` [#162] (Thanks, @jaredbeck!) * Allow CSS keywords `thick` and `thin` [#168] (Thanks, @georgeclaghorn!) * Allow HTML property `contenteditable` [#167] (Thanks, @andreynering!) ### Bug fixes * CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [#165] (Thanks, @asok!) ### Deprecations / Name Changes The following method and constants are hereby deprecated, and will be completely removed in a future release: * Deprecate `Loofah::Helpers::ActionView.white_list_sanitizer`, please use `Loofah::Helpers::ActionView.safe_list_sanitizer` instead. * Deprecate `Loofah::Helpers::ActionView::WhiteListSanitizer`, please use `Loofah::Helpers::ActionView::SafeListSanitizer` instead. * Deprecate `Loofah::HTML5::WhiteList`, please use `Loofah::HTML5::SafeList` instead. Thanks to @JuanitoFatas for submitting these changes in #164 and for making the language used in Loofah more inclusive.


        Pullup ticket #6074 - requested by taca

@danfstucky

www/ruby-loofah: seucurity fix Revisions pulled up: - www/ruby-loofah/Makefile 1.6 - www/ruby-loofah/PLIST 1.5 - www/ruby-loofah/distinfo 1.6 --- Module Name: pkgsrc Committed By: taca Date: Tue Oct 22 16:24:20 UTC 2019 Modified Files: pkgsrc/www/ruby-loofah: Makefile PLIST distinfo Log Message: www/ruby-loofah: update to 2.3.1 ## 2.3.1 / 2019-10-22 ### Security Address CVE-2019-15587: Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. This CVE's public notice is at flavorjones/loofah#171 ## 2.3.0 / unreleased ### Features * Expand set of allowed protocols to include `tel:` and `line:`. [#104, #147] * Expand set of allowed CSS functions. [related to #122] * Allow greater precision in shorthand CSS values. [#149] (Thanks, @danfstucky!) * Allow CSS property `list-style` [#162] (Thanks, @jaredbeck!) * Allow CSS keywords `thick` and `thin` [#168] (Thanks, @georgeclaghorn!) * Allow HTML property `contenteditable` [#167] (Thanks, @andreynering!) ### Bug fixes * CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [#165] (Thanks, @asok!) ### Deprecations / Name Changes The following method and constants are hereby deprecated, and will be completely removed in a future release: * Deprecate `Loofah::Helpers::ActionView.white_list_sanitizer`, please use `Loofah::Helpers::ActionView.safe_list_sanitizer` instead. * Deprecate `Loofah::Helpers::ActionView::WhiteListSanitizer`, please use `Loofah::Helpers::ActionView::SafeListSanitizer` instead. * Deprecate `Loofah::HTML5::WhiteList`, please use `Loofah::HTML5::SafeList` instead. Thanks to @JuanitoFatas for submitting these changes in #164 and for making the language used in Loofah more inclusive.


        Update loofah for CVE-2019-15587.

Name: loofah Version: 2.3.0 Advisory: CVE-2019-15587 Criticality: Unknown URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1


        Update loofah for CVE-2019-15587.

Name: loofah Version: 2.3.0 Advisory: CVE-2019-15587 Criticality: Unknown URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1


        Bump Loofah version to 2.3.1

Vulnerability CVE-2019-15587 In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. flavorjones/loofah#171


        Update vulnerable package

Name: loofah Version: 2.3.0 Advisory: CVE-2019-15587 Criticality: Unknown URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1


        bundle update loofah (CVE-2019-15587)

mr run: /home/travis/build/twingly/audit/repos/feedjira.herokuapp.com Name: loofah Version: 2.2.3 Advisory: CVE-2019-15587 Criticality: Unknown URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1


        loofah vulnerability CVE-2019-15587

Name: loofah Version: 2.2.3 Advisory: CVE-2019-15587 Criticality: Unknown URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1


        Bump loofah from 2.2.3 to 2.3.1 (#2728)

@jshoe

Bump loofah from 2.2.3 to 2.3.1Bumps [loofah](https://github.com/flavorjones/loofah) from 2.2.3 to 2.3.1. <details> <summary>Release notes</summary> *Sourced from [loofah's releases](https://github.com/flavorjones/loofah/releases).* > ## 2.3.1 / 2019-10-22 > > ### Security > > Address CVE-2019-15587: Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. > > This CVE's public notice is at [flavorjones/loofah#171](https://github-redirect.dependabot.com/flavorjones/loofah/issues/171) > > ## 2.3.0 / 2019-09-28 > > ### Features > > * Expand set of allowed protocols to include `tel:` and `line:`. [#104, [#147](https://github-redirect.dependabot.com/flavorjones/loofah/issues/147)] > * Expand set of allowed CSS functions. [related to [#122](https://github-redirect.dependabot.com/flavorjones/loofah/issues/122)] > * Allow greater precision in shorthand CSS values. [#149](https://github-redirect.dependabot.com/flavorjones/loofah/issues/149) (Thanks, [@danfstucky](https://github.com/danfstucky)!) > * Allow CSS property `list-style` [#162](https://github-redirect.dependabot.com/flavorjones/loofah/issues/162) (Thanks, [@jaredbeck](https://github.com/jaredbeck)!) > * Allow CSS keywords `thick` and `thin` [#168](https://github-redirect.dependabot.com/flavorjones/loofah/issues/168) (Thanks, [@georgeclaghorn](https://github.com/georgeclaghorn)!) > * Allow HTML property `contenteditable` [#167](https://github-redirect.dependabot.com/flavorjones/loofah/issues/167) (Thanks, [@andreynering](https://github.com/andreynering)!) > > > ### Bug fixes > > * CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [#165](https://github-redirect.dependabot.com/flavorjones/loofah/issues/165) (Thanks, [@asok](https://github.com/asok)!) > > > ### Deprecations / Name Changes > > The following method and constants are hereby deprecated, and will be completely removed in a future release: > > * Deprecate `Loofah::Helpers::ActionView.white_list_sanitizer`, please use `Loofah::Helpers::ActionView.safe_list_sanitizer` instead. > * Deprecate `Loofah::Helpers::ActionView::WhiteListSanitizer`, please use `Loofah::Helpers::ActionView::SafeListSanitizer` instead. > * Deprecate `Loofah::HTML5::WhiteList`, please use `Loofah::HTML5::SafeList` instead. > > Thanks to [@JuanitoFatas](https://github.com/JuanitoFatas) for submitting these changes in [#164](https://github-redirect.dependabot.com/flavorjones/loofah/issues/164) and for making the language used in Loofah more inclusive. > > </details> <details> <summary>Changelog</summary> *Sourced from [loofah's changelog](https://github.com/flavorjones/loofah/blob/master/CHANGELOG.md).* > ## 2.3.1 / 2019-10-22 > > ### Security > > Address CVE-2019-15587: Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. > > This CVE's public notice is at [flavorjones/loofah#171](https://github-redirect.dependabot.com/flavorjones/loofah/issues/171) > > > ## 2.3.0 / 2019-09-28 > > ### Features > > * Expand set of allowed protocols to include `tel:` and `line:`. [#104, [#147](https://github-redirect.dependabot.com/flavorjones/loofah/issues/147)] > * Expand set of allowed CSS functions. [related to [#122](https://github-redirect.dependabot.com/flavorjones/loofah/issues/122)] > * Allow greater precision in shorthand CSS values. [#149](https://github-redirect.dependabot.com/flavorjones/loofah/issues/149) (Thanks, [@danfstucky](https://github.com/danfstucky)!) > * Allow CSS property `list-style` [#162](https://github-redirect.dependabot.com/flavorjones/loofah/issues/162) (Thanks, [@jaredbeck](https://github.com/jaredbeck)!) > * Allow CSS keywords `thick` and `thin` [#168](https://github-redirect.dependabot.com/flavorjones/loofah/issues/168) (Thanks, [@georgeclaghorn](https://github.com/georgeclaghorn)!) > * Allow HTML property `contenteditable` [#167](https://github-redirect.dependabot.com/flavorjones/loofah/issues/167) (Thanks, [@andreynering](https://github.com/andreynering)!) > > > ### Bug fixes > > * CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [#165](https://github-redirect.dependabot.com/flavorjones/loofah/issues/165) (Thanks, [@asok](https://github.com/asok)!) > > > ### Deprecations / Name Changes > > The following method and constants are hereby deprecated, and will be completely removed in a future release: > > * Deprecate `Loofah::Helpers::ActionView.white_list_sanitizer`, please use `Loofah::Helpers::ActionView.safe_list_sanitizer` instead. > * Deprecate `Loofah::Helpers::ActionView::WhiteListSanitizer`, please use `Loofah::Helpers::ActionView::SafeListSanitizer` instead. > * Deprecate `Loofah::HTML5::WhiteList`, please use `Loofah::HTML5::SafeList` instead. > > Thanks to [@JuanitoFatas](https://github.com/JuanitoFatas) for submitting these changes in [#164](https://github-redirect.dependabot.com/flavorjones/loofah/issues/164) and for making the language used in Loofah more inclusive. </details> <details> <summary>Commits</summary> - [`83df303`](flavorjones/loofah@83df303) version bump to v2.3.1 - [`e323a77`](flavorjones/loofah@e323a77) Merge pull request [#172](https://github-redirect.dependabot.com/flavorjones/loofah/issues/172) from flavorjones/171-xss-vulnerability - [`1d81f91`](flavorjones/loofah@1d81f91) update CHANGELOG - [`0c6617a`](flavorjones/loofah@0c6617a) mitigate XSS vulnerability in SVG animate attributes - [`a5bd819`](flavorjones/loofah@a5bd819) rufo formatting - [`1bdf276`](flavorjones/loofah@1bdf276) formatting in README - [`1908dc2`](flavorjones/loofah@1908dc2) update CHANGELOG with release date - [`bcbd7b3`](flavorjones/loofah@bcbd7b3) update dev gemspec - [`f6d4c2d`](flavorjones/loofah@f6d4c2d) version bump to v2.3.0 - [`08fee8c`](flavorjones/loofah@08fee8c) update dev deps - Additional commits viewable in [compare view](flavorjones/loofah@v2.2.3...v2.3.1) </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=loofah&package-manager=bundler&previous-version=2.2.3&new-version=2.3.1)](https://help.github.com/articles/configuring-automated-security-fixes) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) Dependabot will merge this PR once CI passes on it, as requested by @jshoe. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/chanzuckerberg/idseq-web/network/alerts). </details>


        Bumps [loofah](https://github.com/flavorjones/loofah) from 2.2.3 to 2…

….3.1. <details> Upgrade loofah *Sourced from [loofah's releases](https://github.com/flavorjones/loofah/releases).* > ## 2.3.1 / 2019-10-22 > > ### Security > > Address CVE-2019-15587: Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. > > This CVE's public notice is at [flavorjones/loofah#171](https://github-redirect.dependabot.com/flavorjones/loofah/issues/171) >


        fix vulnerabilities loofah nokogiri puma in 1.9

Name: loofah Version: 2.2.3 Advisory: CVE-2019-15587 Criticality: Unknown URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1 Name: nokogiri Version: 1.10.4 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5 Name: puma Version: 3.12.1 Advisory: CVE-2019-16770 Criticality: High URL: GHSA-7xx3-m584-x994 Title: Keepalive thread overload/DoS in puma Solution: upgrade to ~> 3.12.2, >= 4.3.1

flavorjones added the security label Oct 9, 2019

flavorjones changed the title ~~placeholder - embargoes security vulnerability~~ placeholder - embargoed security vulnerability Oct 9, 2019

flavorjones added this to the v2.3.1 milestone Oct 22, 2019

flavorjones changed the title ~~placeholder - embargoed security vulnerability~~ CVE-2019-15587 - Loofah XSS Vulnerability Oct 22, 2019

flavorjones closed this Oct 22, 2019

GUI mentioned this issue Oct 22, 2019

Add CVE-2019-15587 for Loofah #420

Merged

kylorhall mentioned this issue Oct 24, 2019

Update loofah for CVE-2019-15587. #40

Merged

kylorhall mentioned this issue Oct 24, 2019

Update loofah for CVE-2019-15587. #126

Merged

cpariwat mentioned this issue Oct 24, 2019

Bump Loofah version to 2.3.1 #134

Merged

rhymes mentioned this issue Oct 24, 2019

Update loofah for CVE-2019-15587 vulnerability #4572

Closed

1 of 4 tasks complete

notapatch mentioned this issue Oct 24, 2019

Build(deps): [Security] Bump loofah from 2.3.0 to 2.3.1 #1120

Merged

dmccurdybah mentioned this issue Oct 24, 2019

Update loofah #469

Merged

edmkitty mentioned this issue Oct 24, 2019

Update loofah gem to fix security vulnerabilities #3468

Merged

lowellrex mentioned this issue Oct 24, 2019

Update Loofah gem to mitigate CVE-2019-15587 #12479

Merged

pdobb mentioned this issue Oct 24, 2019

Add a gem w/ a known security vulnerability #1

Merged

sathishavm mentioned this issue Oct 24, 2019

Project Specific environment variables in preview #3559

Merged

arku mentioned this issue Oct 25, 2019

Update loofah gem to fix vulnerability #112

Merged

pablobm added a commit to pablobm/administrate that referenced this issue Oct 25, 2019

Update vulnerable package

076b2e0

Name: loofah Version: 2.3.0 Advisory: CVE-2019-15587 Criticality: Unknown URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1

senid231 mentioned this issue Oct 27, 2019

loofah vulnerability CVE-2019-15587 #564

Merged

fwolfst mentioned this issue Nov 7, 2019

Bump loofah from 2.2.3 to 2.3.1 #3

Merged

touhouota mentioned this issue Nov 7, 2019

bundle update #22

Merged

fwolfst mentioned this issue Nov 9, 2019

Bump loofah from 2.2.3 to 2.3.1 #5

Merged

cantino mentioned this issue Nov 9, 2019

Upgrade loofah and nokogiri #2621

Merged

typeoneerror mentioned this issue Nov 11, 2019

Relax versioning on rubyzip and nokogiri #322

Open

senid231 mentioned this issue Dec 11, 2019

Fix import preview and vulnerabilities [1.9] #576

Open

flavorjones/loofah

CVE-2019-15587 - Loofah XSS Vulnerability #171

CVE-2019-15587 - Loofah XSS Vulnerability #171

flavorjones commented Oct 9, 2019 •

edited

This comment has been minimized.

flavorjones commented Oct 22, 2019

This comment has been minimized.

flavorjones commented Oct 22, 2019

This comment has been minimized.

graaff commented Oct 22, 2019

This comment has been minimized.

flavorjones commented Oct 22, 2019

flavorjones/loofah

Join GitHub today

CVE-2019-15587 - Loofah XSS Vulnerability #171

CVE-2019-15587 - Loofah XSS Vulnerability #171

Comments

flavorjones commented Oct 9, 2019 • edited

CVE-2019-15587 - Loofah XSS Vulnerability

Severity

Description

Affected Versions

Mitigation

References

History of this public disclosure

This comment has been minimized.

flavorjones commented Oct 22, 2019

This comment has been minimized.

flavorjones commented Oct 22, 2019

This comment has been minimized.

graaff commented Oct 22, 2019

This comment has been minimized.

flavorjones commented Oct 22, 2019

flavorjones commented Oct 9, 2019 •

edited