GHSA-pq4g-8rxf-4g29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

• RubyGems crass: < 1.0.8 → fixed in 1.0.8

Summary Crass's tokenizer didn't terminate a bad URL token at a `)` that followed an escaped backslash (`\\`). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including `@import`) that the sanitizer would otherwise have removed, but that a browser would then parse and apply. Details While consuming the remnants of a bad URL (CSS Syntax Level 3, §4.3.15), Crass checked whether the *previously consumed* code point and the next code point formed a valid escape, in addition to checking the next two unconsumed code points. After an escaped backslash, the previously consumed code point is a backslash, so a following `)` was incorrectly treated as escaped and the bad URL token continued until the next unescaped `)` or the end of the input. Browsers terminate the bad URL at that `)`, so everything Crass treated as part of the bad URL is live CSS to a browser. This bug has existed in every released version of Crass. Impact Crass by itself only mis-tokenizes input. The security impact is on CSS sanitizers that use Crass to make allow/deny decisions and then re-serialize the CSS. Exploitation requires a sanitizer that doesn't reject bad URL tokens wherever they occur. Confirmed examples (verified in Chromium against the sanitizers' output): • Sanitize (all versions through 7.0.0): • In `Sanitize::CSS.properties` and `style` attributes, a bad URL inside a `[...]` or `(...)` block in the value of an allowlisted property can smuggle arbitrary declarations, such as `position: fixed` or a `background-image` URL with a disallowed protocol. • In `Sanitize::CSS.stylesheet` and `` elements, a bad URL in a selector can smuggle arbitrary style rules and at-rules, including `@import`. • Loofah (`Loofah::HTML5::Scrub.scrub_css`, used for `style` attributes), and therefore rails-html-sanitizer (`sanitize_css`, and `sanitize` when `style` is a permitted attribute): a bad URL inside an allowlisted function such as `calc()` or `rgb()` can smuggle declarations Loofah normally strips, such as `position: fixed` and `url()` values. Smuggled CSS can be used for UI redress (clickjacking or phishing overlays), loading attacker-controlled external resources, and, where rules or `@import` can be smuggled, CSS-based data exfiltration. This vulnerability doesn't allow script execution in modern browsers. Patches Fixed in Crass 1.0.8. Users of Sanitize, Loofah, rails-html-sanitizer, or any other library that uses Crass to sanitize CSS should upgrade Crass to 1.0.8 or later. Workarounds There are no practical workarounds other than upgrading. Rejecting any CSS input that contains the character sequence `\\` would block the known trigger, but this is a blunt measure and may reject legitimate CSS. References • CSS Syntax Module Level 3, "Consume the remnants of a bad url": https://drafts.csswg.org/css-syntax-3/#consume-remnants-of-bad-url