Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values

Summary

Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape < and > in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers such as Safari.

Nokogiri 1.19.5 escapes < and > in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.

Impact

Applications that sanitize untrusted HTML with Loofah's HTML5 API (Loofah.html5_fragment, Loofah.html5_document and the scrub_html5_* methods) and display the result to other people are affected, including with the default allowlist.

Not affected: Loofah's HTML4 API (including Loofah::Helpers.sanitize), the :whitewash scrubber, rails-html-sanitizer's default configuration, and JRuby.

Mitigation

Upgrade to Loofah >= 2.25.3, or upgrade Nokogiri to >= 1.19.5.