VDB
KO
LOW

GHSA-vfm5-rmrh-j26v

Possible Content Security Policy bypass in Action Dispatch

Details

There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack.

Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits ------- Thanks to [ryotak](https://hackerone.com/ryotak) for the report!

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems / actionpack
Introduced in: 5.2.0 Fixed in: 7.0.8.7
Fix bundle update actionpack
RubyGems / actionpack
Introduced in: 7.1.0 Fixed in: 7.1.5.1
Fix bundle update actionpack
RubyGems / actionpack
Introduced in: 7.2.0 Fixed in: 7.2.2.1
Fix bundle update actionpack
RubyGems / actionpack
Introduced in: 8.0.0 Fixed in: 8.0.0.1
Fix bundle update actionpack

References