gsd-2020-8264
Vulnerability from gsd
Modified
2020-10-07 00:00
Details
There is a possible XSS vulnerability in Action Pack while the application server is in development mode. This vulnerability is in the Actionable Exceptions middleware. This vulnerability has been assigned the CVE identifier CVE-2020-8264. Versions Affected: >= 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.0.3.4 Impact ------ When an application is running in development mode, and attacker can send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. Workarounds ----------- Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: `config.middleware.delete ActionDispatch::ActionableExceptions`
Aliases
Aliases
CVE-2020-8264


To clipboard 

{
  "GSD": {
    "alias": "CVE-2020-8264",
    "description": "In actionpack gem \u003e= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.",
    "id": "GSD-2020-8264",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-8264.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "actionpack",
            "purl": "pkg:gem/actionpack"
          }
        }
      ],
      "aliases": [
        "CVE-2020-8264",
        "GHSA-35mm-cc6r-8fjp"
      ],
      "details": "There is a possible XSS vulnerability in Action Pack while the application\nserver is in development mode.  This vulnerability is in the Actionable\nExceptions middleware.  This vulnerability has been assigned the CVE\nidentifier CVE-2020-8264.\n\nVersions Affected:  \u003e= 6.0.0\nNot affected:       \u003c 6.0.0\nFixed Versions:     6.0.3.4\n\nImpact\n------\nWhen an application is running in development mode, and attacker can send or\nembed (in another page) a specially crafted URL which can allow the attacker\nto execute JavaScript in the context of the local application.\n\nWorkarounds\n-----------\nUntil such time as the patch can be applied, application developers should\ndisable the Actionable Exceptions middleware in their development environment via\na line such as this one in their config/environment/development.rb:\n\n`config.middleware.delete ActionDispatch::ActionableExceptions`\n",
      "id": "GSD-2020-8264",
      "modified": "2020-10-07T00:00:00.000Z",
      "published": "2020-10-07T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 6.1,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Possible XSS Vulnerability in Action Pack in Development Mode"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "support@hackerone.com",
        "ID": "CVE-2020-8264",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "https://github.com/rails/rails",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "6.0.3.4"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In actionpack gem \u003e= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Cross-site Scripting (XSS) - Reflected (CWE-79)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://hackerone.com/reports/904059",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/904059"
          },
          {
            "name": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ",
            "refsource": "MISC",
            "url": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2020-8264",
      "cvss_v3": 6.1,
      "date": "2020-10-07",
      "description": "There is a possible XSS vulnerability in Action Pack while the application\nserver is in development mode.  This vulnerability is in the Actionable\nExceptions middleware.  This vulnerability has been assigned the CVE\nidentifier CVE-2020-8264.\n\nVersions Affected:  \u003e= 6.0.0\nNot affected:       \u003c 6.0.0\nFixed Versions:     6.0.3.4\n\nImpact\n------\nWhen an application is running in development mode, and attacker can send or\nembed (in another page) a specially crafted URL which can allow the attacker\nto execute JavaScript in the context of the local application.\n\nWorkarounds\n-----------\nUntil such time as the patch can be applied, application developers should\ndisable the Actionable Exceptions middleware in their development environment via\na line such as this one in their config/environment/development.rb:\n\n`config.middleware.delete ActionDispatch::ActionableExceptions`\n",
      "framework": "rails",
      "gem": "actionpack",
      "ghsa": "35mm-cc6r-8fjp",
      "patched_versions": [
        "\u003e= 6.0.3.4"
      ],
      "title": "Possible XSS Vulnerability in Action Pack in Development Mode",
      "unaffected_versions": [
        "\u003c 6.0.0"
      ],
      "url": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=6.0.0 \u003c6.0.3.4",
          "affected_versions": "All versions starting from 6.0.0 before 6.0.3.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2021-01-12",
          "description": "In actionpack gem, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.",
          "fixed_versions": [
            "6.0.3.4"
          ],
          "identifier": "CVE-2020-8264",
          "identifiers": [
            "CVE-2020-8264"
          ],
          "not_impacted": "All versions before 6.0.0, all versions starting from 6.0.3.4",
          "package_slug": "gem/actionpack",
          "pubdate": "2021-01-06",
          "solution": "Upgrade to version 6.0.3.4 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-8264",
            "https://hackerone.com/reports/904059",
            "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ"
          ],
          "uuid": "326dbf13-205f-4628-a76d-d6159f8a3444"
        },
        {
          "affected_range": "\u003e=6.0.0 \u003c6.0.3.4",
          "affected_versions": "All versions starting from 6.0.0 before 6.0.3.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2021-01-12",
          "description": "In actionpack gem, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.",
          "fixed_versions": [
            "6.0.3.4"
          ],
          "identifier": "CVE-2020-8264",
          "identifiers": [
            "CVE-2020-8264"
          ],
          "not_impacted": "All versions before 6.0.0, all versions starting from 6.0.3.4",
          "package_slug": "gem/rails",
          "pubdate": "2021-01-06",
          "solution": "Upgrade to version 6.0.3.4 or above.",
          "title": "Cross-site Scripting",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-8264"
          ],
          "uuid": "5366d0cf-65d1-4a11-a5d6-0f58c69766df"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.0.3.4",
                "versionStartIncluding": "6.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assignments@hackerone.com",
          "ID": "CVE-2020-8264"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In actionpack gem \u003e= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/904059",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://hackerone.com/reports/904059"
            },
            {
              "name": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2021-01-12T14:17Z",
      "publishedDate": "2021-01-06T21:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.