Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
61 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (config.considerallrequestslocal = true), which is the default in development. Releases The fixed releases are available at the normal locations. Credit This issue was responsibly reported by Hackerone researcher fbettag.
Recommended action: Upgrade to 8.1.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.1.5.18.0.0.17.0.8.77.2.2.1· Vendor fix available
Issue
There is a possible Cross Site Scripting (XSS) vulnerability in the contentsecuritypolicy helper in Action Pack. Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input. Credits ------- Thanks to ryotak for the report!
Recommended action: Upgrade to 8.0.0.1, 7.2.2.1, 7.1.5.1 or 7.0.8.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.0.8.57.1.4.17.2.1.16.1.7.9· Vendor fix available
Issue
There is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. This vulnerability has been assigned the CVE identifier CVE-2024-47887. Impact ------ For applications using HTTP Token authentication via authenticateorrequestwithhttptoken or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Users on Ruby 3.2 are unaffected by this issue. Credits ------- Thanks to scyoon for reporting
Recommended action: Upgrade to 7.2.1.1, 7.1.4.1, 7.0.8.5 or 6.1.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.0.8.57.1.4.17.2.1.16.1.7.9· Vendor fix available
Issue
There is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-41128. Impact ------ Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Users on Ruby 3.2 are unaffected by this issue. Credits ------- Thanks to scyoon for the report and patches!
Recommended action: Upgrade to 7.2.1.1, 7.1.4.1, 7.0.8.5 or 6.1.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.2.0.beta27.1.3.47.0.8.46.1.7.8· Vendor fix available
Issue
Permissions-Policy is Only Served on HTML Content-Type The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This has been assigned the CVE identifier CVE-2024-28103. Versions Affected: = 6.1.0 Not affected: < 6.1.0 Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4 Impact ------ Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- N/A Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy regarding security issues. They are in git-am format and consist of a single changeset. 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series…
Recommended action: Upgrade to 7.2.0.beta2, 7.1.3.4, 7.0.8.4 or 6.1.7.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Possible XSS Vulnerability in Action Controller There is a possible XSS vulnerability when using the translation helpers (translate, t, etc) in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2024-26143. Versions Affected: = 7.0.0. Not affected: < 7.0.0 Fixed Versions: 7.1.3.1, 7.0.8.1 Impact ------ Applications using translation methods like translate, or t on a controller, with a key ending in "html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. For example, impacted code will look something like this: To reiterate the pre-conditions, applications must: Use a translation function from a controller (i.e. not I18n.t, or t from a view) Use a key that ends in html Use a default value where the default value is untrusted and unescaped input Send the text to the victim (whether that's part of a template, or a render call) All users running an affected release…
Recommended action: Upgrade to 7.1.3.1 or 7.0.8.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Possible ReDoS vulnerability in Accept header parsing in Action Dispatch There is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-26142. Versions Affected: = 7.1.0, < 7.1.3.1 Not affected: < 7.1.0 Fixed Versions: 7.1.3.1 Impact ------ Carefully crafted Accept headers can cause Accept header parsing in Action Dispatch to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- There are no feasible workarounds for this issue. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series.…
Recommended action: Upgrade to 7.1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The redirectto method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362. Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4 Impact This introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rails = 7.0.x). Releases The FIXED releases are available at the normal locations. Workarounds Avoid providing user supplied URLs with arbitrary schemes to the redirectto method.
Recommended action: Upgrade to 7.0.5.1 or 6.1.7.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792. Versions Affected: = 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1 Impact Specially crafted cookies, in combination with a specially crafted XFORWARDEDHOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. Releases The FIXED releases are available at the normal locations. Workarounds We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious XFORWARDEDHOST headers before they reach the application. Patches To aid users…
Recommended action: Upgrade to 7.0.4.1, 6.1.7.1 or 5.2.8.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a vulnerability in Action Controller’s redirectto. This vulnerability has been assigned the CVE identifier CVE-2023-22797. Versions Affected: = 7.0.0 Not affected: < 7.0.0 Fixed Versions: 7.0.4.1 Impact There is a possible open redirect when using the redirectto helper with untrusted user input. Vulnerable code will look like this: Rails 7.0 introduced protection against open redirects from calling redirectto with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could be bypassed by a carefully crafted URL. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases The FIXED releases are available at the normal locations. Workarounds There are no feasible workarounds for this issue. Patches To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and…
Recommended action: Upgrade to 7.0.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1 Impact A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. Releases The FIXED releases are available at the normal locations. Workarounds We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious If-None-Match headers before they reach the application.…
Recommended action: Upgrade to 7.0.4.1 or 6.1.7.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
5.2.7.16.0.4.87.0.2.46.1.5.1· Vendor fix available
Issue
There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been assigned the CVE identifier CVE-2022-22577. Versions Affected: = 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1 Impact CSP headers were only sent along with responses that Rails considered as "HTML" responses. This left API requests without CSP headers, which could possibly expose users to XSS attacks. Releases The FIXED releases are available at the normal locations. Workarounds Set a CSP for your API responses manually.
Recommended action: Upgrade to 7.0.2.4, 6.1.5.1, 6.0.4.8 or 5.2.7.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site scripting vulnerability flaw was found in the autolink function in Rails before version 3.0.6.
Recommended action: Upgrade to 3.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.0.2.26.0.4.66.1.4.65.2.6.2· Vendor fix available
Issue
Impact Under certain circumstances response bodies will not be closed, for example a bug in a webserver or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes. Upgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation. Patches This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Workarounds Upgrading is highly recommended, but to work around this problem the following middleware can be used:
Recommended action: Upgrade to 7.0.2.2, 6.1.4.6, 6.0.4.6 or 5.2.6.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this: When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website. This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942. Releases -------- The fixed releases are available at the normal locations. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 6-0-host-authorzation-open-redirect.patch - Patch for 6.0 series 6-1-host-authorzation-open-redirect.patch - Patch for 6.1 series 7-0-host-authorzation-open-redirect.patch - Patch for 7.0 series Please note that only the…
Recommended action: Upgrade to 6.1.4.2 or 6.0.4.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942. Versions Affected: = 6.0.0. Not affected: < 6.0.0 Fixed Versions: 6.1.4.1, 6.0.4.1 Impact Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this: When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website. This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not take in to account domain name case sensitivity. Releases The fixed releases are available at the normal locations. Workarounds In the case a patch can’t be applied, the following monkey patch can be used in…
Recommended action: Upgrade to 6.1.4.1 or 6.0.4.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible DoS vulnerability in the Token Authentication logic in Action Controller. Versions Affected: = 4.0.0 Not affected: < 4.0.0 Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 Impact ------ Impacted code uses authenticateorrequestwithhttptoken or authenticatewithhttptoken for request authentication. Impacted code will look something like this: All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- The following monkey patch placed in an initializer can be used to work around the issue: Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 5-2-http-authentication-dos.patch - Patch for 5.2 series 6-0-http-authentication-dos.patch - Patch for 6.0 series 6-1-http-authentication-dos.patch -…
Recommended action: Upgrade to 6.1.3.2, 6.0.3.7, 5.2.6 or 5.2.4.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact ------ There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the redirectto or polymorphicurl helper with untrusted user input. Vulnerable code will look like this. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The FIXED releases are available at the normal locations. Workarounds ----------- To work around this problem, it is recommended to use an allow list for valid parameters passed from the user. For example, Or force the user input to be cast to a string like this, Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 5-2-information-disclosure.patch - Patch for 5.2 series 6-0-information-disclosure.patch - Patch for 6.0 series 6-1-information-disclosure.patch - Patch for 6.1 series Please note that only…
Recommended action: Upgrade to 6.1.3.2, 6.0.3.7, 5.2.6 or 5.2.4.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible Open Redirect Vulnerability in Action Pack. Versions Affected: = v6.1.0.rc2 Not affected: < v6.1.0.rc2 Fixed Versions: 6.1.3.2 Impact ------ This is similar to CVE-2021-22881. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Since rails/rails@9bc7ea5, strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, config.hosts << "sub.example.com" to permit a request with a Host header value of sub-example.com. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- The following monkey patch put in an initializer can be used as a workaround. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of…
Recommended action: Upgrade to 6.1.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact ------ There is a possible Denial of Service vulnerability in Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- The following monkey patch placed in an initializer can be used to work around the issue. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 6-0-Prevent-catastrophic-backtracking-during-mime-parsin.patch - Patch for 6.0 series 6-1-Prevent-catastrophic-backtracking-during-mime-parsin.patch - Patch for 6.1 series Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued…
Recommended action: Upgrade to 6.1.3.2 or 6.0.3.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In actionpack gem = 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware. Workarounds ----------- Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: config.middleware.delete ActionDispatch::ActionableExceptions
Recommended action: Upgrade to 6.0.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Recommended action: Upgrade to 6.1.2.1 or 6.0.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production. This vulnerability has been assigned the CVE identifier CVE-2020-8185. Versions Affected: 6.0.0 < rails < 6.0.3.2 Not affected: Applications with config.actiondispatch.showexceptions = false (this is not a default setting in production) Fixed Versions: rails = 6.0.3.2 Impact ------ Using this issue, an attacker would be able to execute any migrations that are pending for a Rails app running in production mode. It is important to note that an attacker is limited to running migrations the application developer has already defined in their application and ones that have not already run. Workarounds ----------- Until such time as the patch can be applied, application developers should disable the ActionDispatch middleware in their production environment via a line such as this one in their config/environment/production.rb:…
Recommended action: Upgrade to 6.0.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It is possible to, given a global CSRF token such as the one present in the authenticitytoken meta tag, forge a per-form CSRF token for any action for that session. Impact ------ Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session. Workarounds ----------- This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
Recommended action: Upgrade to 6.0.3.1 or 5.2.4.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a strong parameters bypass vector in ActionPack. Versions Affected: rails <= 6.0.3 Not affected: rails < 5.0.0 Fixed Versions: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ In some cases user supplied information can be inadvertently leaked from Strong Parameters. Specifically the return value of each, or eachvalue, or eachpair will return the underlying "untrusted" hash of data that was read from the parameters. Applications that use this return value may be inadvertently use untrusted user input. Impacted code will look something like this: Note the mistaken use of each in the cleanupparams method in the above example. Workarounds ----------- Do not use the return values of each, eachvalue, or eachpair in your application.
Recommended action: Upgrade to 6.0.3.1 or 5.2.4.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.