Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-3740

CVE-2018-3740: Sanitize vulnerable to Improper Input Validation and Cross-site Scripting

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-3740
GHSA ID
GHSA-7f42-p84j-f58p
EPSS Score
0.4842%
CWE
CWE-20
Published
3/21/2018
Updated
1/23/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
sanitizerubygems>= 3.0.0, < 4.6.34.6.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from libxml2's handling of comments in attributes not being properly escaped, which Sanitize's CleanElement transformer didn't account for. The patch adds explicit escaping for these attributes. The vulnerable function is the attribute processing loop in CleanElement#call, which prior to 4.6.3 didn't include the gsub replacement for spaces and quotes in affected attributes. The commit diff clearly shows the addition of UNSAFE_LIBXML_ESCAPE_REGEX and UNSAFE_LIBXML_ESCAPE_CHARS handling in this function, confirming this was the missing security measure.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W**n S*nitiz* <= *.*.* is us** in *om*in*tion wit* li*xml* >= *.*.*, * sp**i*lly *r**t** *TML *r**m*nt **n **us* li*xml* to **n*r*t* improp*rly *s**p** output, *llowin* non-w*it*list** *ttri*ut*s to ** us** on w*it*list** *l*m*nts. T*is **n *llow *T

Reasoning

T** vuln*r**ility st*ms *rom li*xml*'s **n*lin* o* *omm*nts in *ttri*ut*s not **in* prop*rly *s**p**, w*i** S*nitiz*'s *l**n*l*m*nt tr*ns*orm*r *i*n't ***ount *or. T** p*t** ***s *xpli*it *s**pin* *or t**s* *ttri*ut*s. T** vuln*r**l* *un*tion is t**