From 28efe37bbb09a2ef8b3a65284ab0ffb30b3c3c00 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 8 Jul 2024 14:16:11 +0000
Subject: [PATCH] Publish GHSA-8qgm-g2vv-vwvc

---
 .../GHSA-8qgm-g2vv-vwvc.json                  | 100 ++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/07/GHSA-8qgm-g2vv-vwvc/GHSA-8qgm-g2vv-vwvc.json

diff --git a/advisories/github-reviewed/2024/07/GHSA-8qgm-g2vv-vwvc/GHSA-8qgm-g2vv-vwvc.json b/advisories/github-reviewed/2024/07/GHSA-8qgm-g2vv-vwvc/GHSA-8qgm-g2vv-vwvc.json
new file mode 100644
index 00000000000..425a71b374a
--- /dev/null
+++ b/advisories/github-reviewed/2024/07/GHSA-8qgm-g2vv-vwvc/GHSA-8qgm-g2vv-vwvc.json
@@ -0,0 +1,100 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8qgm-g2vv-vwvc",
+  "modified": "2024-07-08T14:14:44Z",
+  "published": "2024-07-08T14:14:43Z",
+  "aliases": [
+    "CVE-2024-39308"
+  ],
+  "summary": "RailsAdmin Cross-site Scripting vulnerability in the list view",
+  "details": "### Impact\nRailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute.\nThe issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.\n\n### Patches\nUpgrade to [3.1.3](https://rubygems.org/gems/rails_admin/versions/3.1.3) or [2.3.0](https://rubygems.org/gems/rails_admin/versions/2.3.0).\n\n### Workarounds\n1. Copy the index view (located under the path `app/views/rails_admin/main/index.html.erb`) from the RailsAdmin version you use, and place it into your application by using the same path.\n2. Open the view file by an editor, and remove `strip_tags` from the title attribute:\n\n```diff\n               <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>\n                 <% value = property.pretty_value %>\n-                <td class=\"<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>\" title=\"<%= strip_tags(value.to_s) %>\">\n+                <td class=\"<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>\" title=\"<%= value %>\">\n                   <%= value %>\n                 </td>\n               <% end %>\n```\n\n**Note:** The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can't upgrade RailsAdmin now for a reason.\n\n### References\nhttps://owasp.org/www-community/attacks/xss/\nhttps://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "rails_admin"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0.0"
+            },
+            {
+              "fixed": "3.1.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "rails_admin"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.3.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/railsadminteam/rails_admin/issues/3686"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/railsadminteam/rails_admin"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rubygems.org/gems/rails_admin/versions/2.3.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rubygems.org/gems/rails_admin/versions/3.1.3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-08T14:14:43Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file