Crass Ruby CSS Parser Bad URL Handling Issue

Executive Summary

Crass is a Ruby CSS parser that follows CSS Syntax Level 3. Before version 1.0.8, it incorrectly handled a closing parenthesis after an escaped backslash in a bad URL. This caused Crass to keep CSS declarations, style rules, or at-rules inside a bad URL token even though browsers treat them as invalid. A sanitizer using Crass to parse untrusted CSS and reserialize it without rejecting the bad URL could allow malicious CSS for UI redress, external resource loading, or data exfiltration, but it does not enable script execution in modern browsers.

Useful 0 Not Useful 0

Impact Analysis

If you use Crass versions before 1.0.8 to sanitize untrusted CSS, an attacker could craft malicious CSS that bypasses sanitization. This could lead to UI redress attacks, unauthorized resource loading, or data exfiltration. However, modern browsers prevent script execution, limiting the impact to non-script-based attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Update Crass to version 1.0.8 or later to address the vulnerability. If using a Ruby application that depends on Crass, check for updates in your package manager or Gemfile and apply them immediately.

Useful 0 Not Useful 0