CVE-2024-26143
Rails has possible XSS Vulnerability in Action Controller
Impact
# Possible XSS Vulnerability in Action Controller There is a possible XSS vulnerability when using the translation helpers (`translate`, `t`, etc) in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2024-26143. Versions Affected: >= 7.0.0. Not affected: < 7.0.0 Fixed Versions: 7.1.3.1, 7.0.8.1 Impact ------ Applications using translation methods like `translate`, or `t` on a controller, with a key ending in "_html", a `:default` key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. For example, impacted code will look something like this: ```ruby class ArticlesController < ApplicationController def show @message = t("message_html", default: untrusted_input) # The `show` template displays the contents of `@message` end end ``` To reiterate the pre-conditions, applications must: * Use a translation function from a controller (i.e. _not_ I18n.t, or `t` from a view) * Use a key that ends in `_html` * Use a default value where the default value is untrusted and unescaped input * Send the text to the victim (whether that's part of a template, or a `render` call) All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- There are no feasible workarounds for this issue. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 7-0-translate-xss.patch - Patch for 7.0 series * 7-1-translate-xss.patch - Patch for 7.1 series Credits ------- Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the patch and fix!
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | actionpack | >= 7.0.0, < 7.0.8.1 | 7.0.8.1 |
| rubygems | rails | >= 7.0.0, < 7.0.8.1 | 7.0.8.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rubyonrails | Rails | from 7.0.0 before 7.0.8.1 from 7.1.0 before 7.1.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
- https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc
- https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e
- https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.yml
- https://security.netapp.com/advisory/ntap-20240510-0004/
- https://github.com/advisories/GHSA-9822-6m93-xqf4
- https://nvd.nist.gov/vuln/detail/CVE-2024-26143
- https://security.netapp.com/advisory/ntap-20240510-0004