CVE-2024-32463.yml

---
gem: phlex
cve: 2024-32463
ghsa: g7xq-xv8c-h98c
url: https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
title: Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
date: 2024-04-16
description: |
  ### Summary

  There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.

  Our filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`.

  ### Impact

  If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user.

  ```ruby
  a(href: user_profile) { "Profile" }
  ```

  ### Mitigation

  The best way to mitigate this vulnerability is to update to one of the following versions:

  - [1.10.1](https://rubygems.org/gems/phlex/versions/1.10.1)
  - [1.9.2](https://rubygems.org/gems/phlex/versions/1.9.2)
  - [1.8.3](https://rubygems.org/gems/phlex/versions/1.8.3)
  - [1.7.2](https://rubygems.org/gems/phlex/versions/1.7.2)
  - [1.6.3](https://rubygems.org/gems/phlex/versions/1.6.3)
  - [1.5.3](https://rubygems.org/gems/phlex/versions/1.5.3)
  - [1.4.2](https://rubygems.org/gems/phlex/versions/1.4.2)

  ### Workarounds

  Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited.

cvss_v3: 7.1
patched_versions:
  - "~> 1.4.2"
  - "~> 1.5.3"
  - "~> 1.6.3"
  - "~> 1.7.2"
  - "~> 1.8.3"
  - "~> 1.9.2"
  - ">= 1.10.1"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28199
    - https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
    - https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb
    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
    - https://github.com/advisories/GHSA-g7xq-xv8c-h98c