Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Users settings their active admin form legends dynamically may be vulnerable to stored XSS, as long as its value can be injected directly by a malicious user. For example: A public web application allows users to create entities with arbitrary names. Active Admin is used to administrate these entities through a private backend. The form to edit these entities in the private backend has the following shape (note the dynamic name value dependent on an attribute of the resource): Then a malicious user could create an entity with a payload that would get executed in the active admin administrator's browser. Both form blocks with an implicit or explicit name (i.e., both form resource.name or form name: resource.name would suffer from the problem), where the value of the name can be arbitrarily set by non admin users. Patches The problem has been fixed in ActiveAdmin 3.2.2 and ActiveAdmin 4.0.0.beta7. Workarounds Users can workaround this problem without upgrading by explicitly…
Recommended action: Upgrade to 4.0.0.beta7 or 3.2.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration. The attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program. Patches Versions 3.2.0 and above fixed the problem by escaping any data starting with = and other characters used by spreadsheet programs. Workarounds Only turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file. References https://owasp.org/www-community/attacks/CSVInjection https://github.com/activeadmin/activeadmin/pull/8167
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user. The bug affects the functionality to export data as CSV files, and was caused by a variable holding the collection to be exported being shared across threads and not properly synchronized. The attacker would need access to the same ActiveAdmin application as the victim, and could exploit the issue by timing their request immediately before when they know someone else will request a CSV (e.g. via phishing) or request CSVs frequently and hope someone else makes a concurrent request. Patches Versions 2.12.0 and above fixed the problem by completely removing the shared state.
Recommended action: Upgrade to 2.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.