CVE-2024-32970 – Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex

https://notcve.org/view.php?id=CVE-2024-32970

Phlex is a framework for building object-oriented views in Ruby. In affected versions there is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. Since the last two vulnerabilities https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g and https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c, we have invested in extensive browser tests. It was these new tests that helped us uncover these issues. As of now the project exercises every possible attack vector the developers can think of — including enumerating every ASCII character, and we run these tests in Chrome, Firefox and Safari. • https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline https://github.com/payloadbox/xss-payload-list https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2 https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx https://rubygems.org/gems/phlex • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •