Vulnerability · Published Mar 11, 2024 · Assigned by GitHub_M
CVE-2024-28199Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex
High 7.1
In plain English
A high-severity cross-site scripting in phlex from phlex-ruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user. If you splat user-provided attributes when rendering any HTML tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user. Patches are available on RubyGems for all 1.x minor versions. Users are advised to upgrade. Users unable to upgrade should consider configuring a content security policy that does not allow `unsafe-inline`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | phlex | 1.9.1 | GHSA-242p-4v39-2v8g |
| RubyGems | phlex | 1.8.2 | GHSA-242p-4v39-2v8g |
| RubyGems | phlex | 1.7.1 | GHSA-242p-4v39-2v8g |
| RubyGems | phlex | 1.6.2 | GHSA-242p-4v39-2v8g |
| RubyGems | phlex | 1.5.2 | GHSA-242p-4v39-2v8g |
| RubyGems | phlex | 1.4.1 | GHSA-242p-4v39-2v8g |
| RubyGems | phlex | 1.3.3 | GHSA-242p-4v39-2v8g |
| RubyGems | phlex | 1.2.2 | GHSA-242p-4v39-2v8g |
| RubyGems | phlex | 1.1.1 | GHSA-242p-4v39-2v8g |
| RubyGems | phlex | 1.0.1 | GHSA-242p-4v39-2v8g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| phlex-ruby | phlex | = 1.9.0>= 1.8.0, < 1.8.2= 1.7.0>= 1.6.0, < 1.6.2>= 1.5.0, < 1.5.2= 1.4.0>= 1.3.0, < 1.3.3>= 1.2.0, < 1.2.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
References
- https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g x_refsource_CONFIRM
- https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1 x_refsource_MISC
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy x_refsource_MISC
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline x_refsource_MISC