netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-8qgm-g2vv-vwvc

Browse Source
This commit is contained in:
advisory-database[bot]
2024-07-09 13:57:27 +00:00
parent 5f190f4caf
commit c6a5e31299
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/07/GHSA-8qgm-g2vv-vwvc/GHSA-8qgm-g2vv-vwvc.json
+6 -6
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8qgm-g2vv-vwvc",
"modified": "2024-07-08T16:18:40Z",
"modified": "2024-07-09T13:56:22Z",
"published": "2024-07-08T14:14:43Z",
"aliases": [
"CVE-2024-39308"
],
"summary": "RailsAdmin Cross-site Scripting vulnerability in the list view",
"details": "### Impact\nRailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute.\nThe issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.\n\n### Patches\nUpgrade to [3.1.3](https://rubygems.org/gems/rails_admin/versions/3.1.3) or [2.3.0](https://rubygems.org/gems/rails_admin/versions/2.3.0).\n\n### Workarounds\n1. Copy the index view (located under the path `app/views/rails_admin/main/index.html.erb`) from the RailsAdmin version you use, and place it into your application by using the same path.\n2. Open the view file by an editor, and remove `strip_tags` from the title attribute:\n\n```diff\n <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>\n <% value = property.pretty_value %>\n- <td class=\"<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>\" title=\"<%= strip_tags(value.to_s) %>\">\n+ <td class=\"<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>\" title=\"<%= value %>\">\n <%= value %>\n </td>\n <% end %>\n```\n\n**Note:** The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can't upgrade RailsAdmin now for a reason.\n\n### References\nhttps://owasp.org/www-community/attacks/xss/\nhttps://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags",
"details": "### Impact\nRailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute.\nThe issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.\n\n### Patches\n~Upgrade to [3.1.3](https://rubygems.org/gems/rails_admin/versions/3.1.3) or [2.3.0](https://rubygems.org/gems/rails_admin/versions/2.3.0)~.\n**Edit: Patched versions 3.1.3 and 2.3.0 has an functionality issue. 3.x users should upgrade to [3.1.4](https://rubygems.org/gems/rails_admin/versions/3.1.4).\n2.x users can stay on 2.2.1, as it was found out that only 3.x versions are affected by this vulnerability.**\n\n### Workarounds\n1. Copy the index view (located under the path `app/views/rails_admin/main/index.html.erb`) from the RailsAdmin version you use, and place it into your application by using the same path.\n2. Open the view file by an editor, and change the way to populate the td tag:\n\n```diff\n <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>\n <% value = property.pretty_value %>\n- <td class=\"<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>\" title=\"<%= value %>\">\n+ <%= content_tag(:td, class: [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?), title: strip_tags(value.to_s)) do %>\n <%= value %>\n- </td>\n+ <% end %>\n <% end %>\n```\n\n**Note:** The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can't upgrade RailsAdmin now for a reason.\n\n### References\nhttps://owasp.org/www-community/attacks/xss/\nhttps://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags",
"severity": [
{
"type": "CVSS_V3",
@@ -29,10 +29,10 @@
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
"introduced": "0"
},
{
"fixed": "3.1.3"
"fixed": "2.3.0"
}
]
}
@@ -48,10 +48,10 @@
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
"introduced": "3.0.0.beta"
},
{
"fixed": "2.3.0"
"fixed": "3.1.3"
}
]
}