Loofah Gem Vulnerability: Potential XSS via Split javascript: URIs
An early warning has been issued regarding a potential cross-site scripting (XSS) vulnerability in the Loofah gem's allowed_uri? method, which may not detect javascript: URIs split by numeric character references without semicolons. This issue affects various versions of the Loofah gem.
What happened
Reportedly, the Loofah gem's allowed_uri? method does not correctly identify javascript: URIs that are split using numeric character references without semicolons. This is a bypass of a previous fix that only handled references with trailing semicolons. As a result, there is a potential for XSS vulnerabilities in applications that use this method with user-controlled input.
Developers using the Loofah gem are advised to avoid using the allowed_uri? method with user-controlled input until a patch is released. The affected versions of the Loofah gem range from 2.1.0 to 2.25.0, with some versions having specific fixes applied. For a complete list of affected and fixed versions, primary sources should be consulted.
The severity of this issue is currently under investigation, and further details may emerge as the situation develops. It is recommended that developers stay updated with the latest advisories and apply patches as soon as they become available.
How 0Day mitigates this
loofah is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.