CVE-2024-32463: Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
(updated )
There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.
Our filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an <a> tag could be bypassed with tab \t or newline \n characters between the characters of the protocol, e.g. java\tscript:.
References
- developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
- developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
- github.com/advisories/GHSA-g7xq-xv8c-h98c
- github.com/phlex-ruby/phlex
- github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb
- github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
- github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32463.yml
- nvd.nist.gov/vuln/detail/CVE-2024-32463
Code Behaviors & Features
Detect and mitigate CVE-2024-32463 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →