GSD-2020-8264

Vulnerability from gsd - Updated: 2020-10-07 00:00
Details
There is a possible XSS vulnerability in Action Pack while the application server is in development mode. This vulnerability is in the Actionable Exceptions middleware. This vulnerability has been assigned the CVE identifier CVE-2020-8264. Versions Affected: >= 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.0.3.4 Impact ------ When an application is running in development mode, and attacker can send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. Workarounds ----------- Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: `config.middleware.delete ActionDispatch::ActionableExceptions`
Aliases
Aliases
CVE-2020-8264
To clipboard 

{
  "GSD": {
    "alias": "CVE-2020-8264",
    "description": "In actionpack gem \u003e= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.",
    "id": "GSD-2020-8264",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-8264.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "actionpack",
            "purl": "pkg:gem/actionpack"
          }
        }
      ],
      "aliases": [
        "CVE-2020-8264",
        "GHSA-35mm-cc6r-8fjp"
      ],
      "details": "There is a possible XSS vulnerability in Action Pack while the application\nserver is in development mode.  This vulnerability is in the Actionable\nExceptions middleware.  This vulnerability has been assigned the CVE\nidentifier CVE-2020-8264.\n\nVersions Affected:  \u003e= 6.0.0\nNot affected:       \u003c 6.0.0\nFixed Versions:     6.0.3.4\n\nImpact\n------\nWhen an application is running in development mode, and attacker can send or\nembed (in another page) a specially crafted URL which can allow the attacker\nto execute JavaScript in the context of the local application.\n\nWorkarounds\n-----------\nUntil such time as the patch can be applied, application developers should\ndisable the Actionable Exceptions middleware in their development environment via\na line such as this one in their config/environment/development.rb:\n\n`config.middleware.delete ActionDispatch::ActionableExceptions`\n",
      "id": "GSD-2020-8264",
      "modified": "2020-10-07T00:00:00.000Z",
      "published": "2020-10-07T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 6.1,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Possible XSS Vulnerability in Action Pack in Development Mode"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "support@hackerone.com",
        "ID": "CVE-2020-8264",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "https://github.com/rails/rails",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "6.0.3.4"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In actionpack gem \u003e= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Cross-site Scripting (XSS) - Reflected (CWE-79)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://hackerone.com/reports/904059",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/904059"
          },
          {
            "name": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ",
            "refsource": "MISC",
            "url": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2020-8264",
      "cvss_v3": 6.1,
      "date": "2020-10-07",
      "description": "There is a possible XSS vulnerability in Action Pack while the application\nserver is in development mode.  This vulnerability is in the Actionable\nExceptions middleware.  This vulnerability has been assigned the CVE\nidentifier CVE-2020-8264.\n\nVersions Affected:  \u003e= 6.0.0\nNot affected:       \u003c 6.0.0\nFixed Versions:     6.0.3.4\n\nImpact\n------\nWhen an application is running in development mode, and attacker can send or\nembed (in another page) a specially crafted URL which can allow the attacker\nto execute JavaScript in the context of the local application.\n\nWorkarounds\n-----------\nUntil such time as the patch can be applied, application developers should\ndisable the Actionable Exceptions middleware in their development environment via\na line such as this one in their config/environment/development.rb:\n\n`config.middleware.delete ActionDispatch::ActionableExceptions`\n",
      "framework": "rails",
      "gem": "actionpack",
      "ghsa": "35mm-cc6r-8fjp",
      "patched_versions": [
        "\u003e= 6.0.3.4"
      ],
      "title": "Possible XSS Vulnerability in Action Pack in Development Mode",
      "unaffected_versions": [
        "\u003c 6.0.0"
      ],
      "url": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=6.0.0 \u003c6.0.3.4",
          "affected_versions": "All versions starting from 6.0.0 before 6.0.3.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2021-01-12",
          "description": "In actionpack gem, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.",
          "fixed_versions": [
            "6.0.3.4"
          ],
          "identifier": "CVE-2020-8264",
          "identifiers": [
            "CVE-2020-8264"
          ],
          "not_impacted": "All versions before 6.0.0, all versions starting from 6.0.3.4",
          "package_slug": "gem/actionpack",
          "pubdate": "2021-01-06",
          "solution": "Upgrade to version 6.0.3.4 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-8264",
            "https://hackerone.com/reports/904059",
            "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ"
          ],
          "uuid": "326dbf13-205f-4628-a76d-d6159f8a3444"
        },
        {
          "affected_range": "\u003e=6.0.0 \u003c6.0.3.4",
          "affected_versions": "All versions starting from 6.0.0 before 6.0.3.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2021-01-12",
          "description": "In actionpack gem, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.",
          "fixed_versions": [
            "6.0.3.4"
          ],
          "identifier": "CVE-2020-8264",
          "identifiers": [
            "CVE-2020-8264"
          ],
          "not_impacted": "All versions before 6.0.0, all versions starting from 6.0.3.4",
          "package_slug": "gem/rails",
          "pubdate": "2021-01-06",
          "solution": "Upgrade to version 6.0.3.4 or above.",
          "title": "Cross-site Scripting",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-8264"
          ],
          "uuid": "5366d0cf-65d1-4a11-a5d6-0f58c69766df"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.0.3.4",
                "versionStartIncluding": "6.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assignments@hackerone.com",
          "ID": "CVE-2020-8264"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In actionpack gem \u003e= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/904059",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://hackerone.com/reports/904059"
            },
            {
              "name": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2021-01-12T14:17Z",
      "publishedDate": "2021-01-06T21:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.