[CVE-2018-3740] Sanitize HTML injection vulnerability

[rgrove]

This is a public disclosure of an HTML injection vulnerability in Sanitize that could allow XSS. I’d like to thank the Shopify Application Security Team for responsibly reporting this vulnerability.

Description

A specially crafted HTML fragment can cause Sanitize to allow non-whitelisted attributes to be used on a whitelisted HTML element.

Affected Versions

Sanitize < 4.6.3, but only in combination with libxml2 >= 2.9.2

Mitigation

Upgrade to Sanitize 4.6.3 or higher.

History of this vulnerability

• 2018-03-19: Reported by Shopify Application Security Team via email
• 2018-03-19: Sanitize 4.6.3 released with a fix
• 2018-03-19: Initial vulnerability report published

[reedloden]

@rgrove Is there a CVE for this? If not, can assign one.

[rgrove]

There isn't. If you could assign one, that'd be great! I tried to figure out how to request one but it was taking me too long, so I figured I'd get the fix out first.

[reedloden]

Sure, CVE-2018-3740.

Since Shopify (the reporter) is a HackerOne customer, I can assign one for you under our CNA scope. :-)

[rgrove]

Much appreciated!

[rgrove]

It looks like the root cause of this issue is being discussed in this libxml2 bug: https://bugzilla.gnome.org/show_bug.cgi?id=769760

[flavorjones]

@rgrove I've noted this CVE in that upstream bug report.

[rgrove]

Thanks @flavorjones! Also thanks for providing a good example for me to follow in terms of announcing a vuln and getting the word out to the community. First time I've done that, so it was a learning experience. 😬

[flavorjones]

Ha ha! Well, we have a good process for all this at my day job, so "I'm just following procedure."

[rgrove]

FYI if you're still on the Sanitize 2.x line and can't upgrade to 4.x, @dometto was kind enough to backport this fix to the 2.x line in Sanitize 2.1.1.