Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
13 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Releases The fixed releases are available at the normal locations. Credit This issue was responsibly reported by Hackerone researcher taise.
Recommended action: Upgrade to 8.1.2.1, 8.0.4.1 or 7.2.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
NOTE: rails-ujs is part of Rails/actionview since 5.1.0. There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute. This vulnerability has been assigned the CVE identifier CVE-2023-23913. Not affected: < 5.1.0 Versions Affected: = 5.1.0 Fixed Versions: 6.1.7.3, 7.0.4.3 Impact If the specified malicious HTML clipboard content is provided to a contenteditable element, this could result in the arbitrary execution of javascript on the origin in question. Releases The FIXED releases are available at the normal locations. Workarounds We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can attempt to mitigate this vulnerability by removing the contenteditable attribute from…
Recommended action: Upgrade to 7.0.4.3 or 6.1.7.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
5.2.7.16.0.4.87.0.2.46.1.5.1· Vendor fix available
Issue
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777. Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1 Impact If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability. Impacted code will look something like this: Where the "maliciousinput" variable contains untrusted data. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases The FIXED releases are available at the normal locations. Workarounds Escape the untrusted data before using it as a key for tag helper methods.
Recommended action: Upgrade to 7.0.2.4, 6.1.5.1, 6.0.4.8 or 5.2.7.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the t and translate helpers could be susceptible to XSS attacks. Impact When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in html, the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples: Patches Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations. The patches have also been applied to the master, 6-0-stable, and 5-2-stable branches on GitHub. If you track any of these branches, you should update to the latest. To aid users who aren’t able to upgrade immediately, we’ve provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 5-2-translate-helper-xss.patch — patch for the 5.2 release series…
Recommended action: Upgrade to 6.0.3.3 or 5.2.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render call to perform a RCE.
Recommended action: Upgrade to 4.2.11.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains. Versions Affected: rails <= 6.0.3 Not affected: Applications which don't use rails-ujs. Fixed Versions: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ This is a regression of CVE-2015-1840. In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent. Workarounds ----------- To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters. For example, code like this: linkto params to code like this: linkto filteredparams def filteredparams Filter just the parameters that you trust end
Recommended action: Upgrade to 6.0.3.1 or 5.2.4.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escapejavascript methods may be susceptible to XSS attacks. Impact There is a possible XSS vulnerability in the j and escapejavascript methods in ActionView. These methods are used for escaping JavaScript string literals. Impacted code will look something like this: or Releases The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations. Workarounds For those that can't upgrade, the following monkey patch may be used: Patches To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 5-2-js-helper-xss.patch - Patch for 5.2 series 6-0-js-helper-xss.patch - Patch for 6.0 series Please note that only the 5.2 and 6.0 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible…
Recommended action: Upgrade to 6.0.2.2 or 5.2.4.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
5.1.6.24.2.11.15.2.2.15.0.7.2· Vendor fix available
Issue
File Content Disclosure in Action View Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents. The impact is limited to calls to render which render file contents without a specified accept format. Impacted code in a controller looks something like this: Rendering templates as opposed to files is not impacted by this vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations. Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this: In summary, impacted calls to render look like this: The vulnerability can be mitigated by changing to this: Other calls to…
Recommended action: Upgrade to 5.2.2.1, 5.1.6.2, 5.0.7.2 or 4.2.11.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
5.1.6.24.2.11.16.0.0.beta35.2.2.15.0.7.2· Vendor fix available
Issue
Denial of Service Vulnerability in Action View Impact ------ Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests. This impacts all Rails applications that render views. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations. Workarounds ----------- This vulnerability can be mitigated by wrapping render calls with respondto blocks. For example, the following example is vulnerable: But the following code is not vulnerable: Implicit rendering is impacted, so this code is vulnerable: But can be changed this this: Alternatively to specifying the format, the following monkey patch can be applied in an initializer: Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier…
Recommended action: Upgrade to 6.0.0.beta3, 5.2.2.1, 5.1.6.2 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
Recommended action: Upgrade to 3.0.4 or 2.3.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all possible scenarios. This vulnerability has been assigned the CVE identifier CVE-2016-2097. Versions Affected: 3.2.x, 4.0.x, 4.1.x Not affected: 4.2+ Fixed Versions: 3.2.22.2, 4.1.14.2 Impact ------ Applications that pass unverified user input to the render method in a controller may be vulnerable to an information leak vulnerability. Impacted code will look something like this: Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The FIXED releases are available at the normal locations. Workarounds ----------- A workaround to this issue is…
Recommended action: Upgrade to 4.1.14.2 or 3.2.22.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Recommended action: Upgrade to 5.0.0.1, 4.2.7.1 or 3.2.22.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Recommended action: Upgrade to 4.2.5.1 or 4.1.14.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.