Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
CarrierWave's contenttypedenylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. Note: CarrierWave is aware #contenttypedenylist is deprecated for the security reason, but it still used by developers, and the problem here isn't denylist allows any filetype, and thats not a vulnerability in carrierwave, its an implementation problem in developers using CarrierWave, the problem is its denylist entries are interpolated directly into a regex without Regexp.quote or anchoring. The denylist is still useful when developers want to ban specific content types but allow everything else. Details In lib/carrierwave/uploader/contenttypedenylist.rb:57, string denylist entries are interpolated directly into a regex without Regexp.quote or anchoring: Other affected MIME types include application/xhtml+xml and any type containing regex metacharacters. Fix: Apply Regexp.quote for string entries…
Recommended action: Upgrade to 3.1.3 or 2.2.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by contenttypeallowlist, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Patches Upgrade to 3.0.7 or 2.2.6. Workarounds Use the following monkey patch to let CarrierWave parse the Content-type by using Marcel::MimeType.for. References OWASP - File Upload Cheat Sheet
Recommended action: Upgrade to 3.0.7 or 2.2.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact CarrierWave::Uploader::ContentTypeAllowlist has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in allowlistedcontenttype? determines Content-Type permissions by performing a partial match. If the contenttype argument of allowlistedcontenttype? is passed a value crafted by the attacker, Content-Types not included in the contenttypeallowlist will be allowed. In addition, by setting the Content-Type configured by the attacker at the time of file delivery, it is possible to cause XSS on the user's browser when the uploaded file is opened. Patches Upgrade to 3.0.5 or 2.2.5. Workarounds When validating with allowlistedcontenttype? in CarrierWave::Uploader::ContentTypeAllowlist , forward match(\A) the Content-Type set in contenttypeallowlist, preventing unintentional permission of text/html;image/png when you want to allow only image/png in contenttypeallowlist. References OWASP - File Upload Cheat Sheet
Recommended action: Upgrade to 3.0.5 or 2.2.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact CarrierWave::RMagick has a Code Injection vulnerability. Its #manipulate! method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). (But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to DoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension) Proof of Concept Patches Upgrade to 2.1.1 or 1.3.2. Workarounds Stop supplying untrusted input to #manipulate!'s mutation option. References Code Injection Software Attack For more information If you have any questions or comments about this advisory: Open an issue in CarrierWave repo Email me at mit.shibuya@gmail.com
Recommended action: Upgrade to 2.1.1 or 1.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact CarrierWave download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. Patches Upgrade to 2.1.1 or 1.3.2. Workarounds Using proper network segmentation and applying the principle of least privilege to outbound connections from application servers can reduce the severity of SSRF vulnerabilities. Ideally the vulnerable gem should run on an isolated server without access to any internal network resources or cloud metadata access. References Server-Side Request Forgery Prevention Cheat Sheet For more information If you have any questions or comments about this advisory: Open an issue in CarrierWave repo Email me at mit.shibuya@gmail.com
Recommended action: Upgrade to 2.1.1 or 1.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.