GHSA-8QGM-G2VV-VWVC

Vulnerability from github – Published: 2024-07-08 14:14 – Updated: 2024-07-11 20:24
VLAI?
Summary
RailsAdmin Cross-site Scripting vulnerability in the list view
Details

Impact

RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. The issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.

Patches

Upgrade to 3.1.4. The vulnerability itself was patched in 3.1.3 but it has a functionality issue. Initially the vulnerability was thought to exist in versions before 3.0, but it didn't. 2.x users can stay on 2.2.1.

Workarounds

  1. Copy the index view (located under the path app/views/rails_admin/main/index.html.erb) from the RailsAdmin version you use, and place it into your application by using the same path.
  2. Open the view file by an editor, and change the way to populate the td tag:
               <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>
                 <% value = property.pretty_value %>
-                <td class="<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>" title="<%= value %>">
+                <%= content_tag(:td, class: [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?), title: strip_tags(value.to_s)) do %>
                   <%= value %>
-                </td>
+                <% end %>
               <% end %>

Note: The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can't upgrade RailsAdmin now for a reason.

References

https://owasp.org/www-community/attacks/xss/ https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags

Severity ?
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
6.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "rails_admin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0.beta"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-39308"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-08T14:14:43Z",
    "nvd_published_at": "2024-07-08T15:15:22Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nRailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute.\nThe issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.\n\n### Patches\nUpgrade to [3.1.4](https://rubygems.org/gems/rails_admin/versions/3.1.4). The vulnerability itself was patched in 3.1.3 but it has a functionality issue.\nInitially the vulnerability was thought to exist in versions before 3.0, but it didn\u0027t. 2.x users can stay on 2.2.1.\n\n### Workarounds\n1. Copy the index view (located under the path `app/views/rails_admin/main/index.html.erb`) from the RailsAdmin version you use, and place it into your application by using the same path.\n2. Open the view file by an editor, and change the way to populate the td tag:\n\n```diff\n               \u003c% properties.map{ |property| property.bind(:object, object) }.each do |property| %\u003e\n                 \u003c% value = property.pretty_value %\u003e\n-                \u003ctd class=\"\u003c%= [property.sticky? \u0026\u0026 \u0027sticky\u0027, property.css_class, property.type_css_class].select(\u0026:present?).join(\u0027 \u0027) %\u003e\" title=\"\u003c%= value %\u003e\"\u003e\n+                \u003c%= content_tag(:td, class: [property.sticky? \u0026\u0026 \u0027sticky\u0027, property.css_class, property.type_css_class].select(\u0026:present?), title: strip_tags(value.to_s)) do %\u003e\n                   \u003c%= value %\u003e\n-                \u003c/td\u003e\n+                \u003c% end %\u003e\n               \u003c% end %\u003e\n```\n\n**Note:** The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can\u0027t upgrade RailsAdmin now for a reason.\n\n### References\nhttps://owasp.org/www-community/attacks/xss/\nhttps://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags",
  "id": "GHSA-8qgm-g2vv-vwvc",
  "modified": "2024-07-11T20:24:10Z",
  "published": "2024-07-08T14:14:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39308"
    },
    {
      "type": "WEB",
      "url": "https://github.com/railsadminteam/rails_admin/issues/3686"
    },
    {
      "type": "WEB",
      "url": "https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef"
    },
    {
      "type": "WEB",
      "url": "https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/railsadminteam/rails_admin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_admin/CVE-2024-39308.yml"
    },
    {
      "type": "WEB",
      "url": "https://rubygems.org/gems/rails_admin/versions/2.3.0"
    },
    {
      "type": "WEB",
      "url": "https://rubygems.org/gems/rails_admin/versions/3.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RailsAdmin Cross-site Scripting vulnerability in the list view"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.