VDB
Sign up
LOW

GHSA-vfm5-rmrh-j26v

Possible Content Security Policy bypass in Action Dispatch

Quick fix

GHSA-vfm5-rmrh-j26v — actionpack: upgrade to the fixed version with the command below.

bundle update actionpack

Details

There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack.

Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits ------- Thanks to [ryotak](https://hackerone.com/ryotak) for the report!

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/actionpack
Introduced in: 5.2.0Fixed in: 7.0.8.7
Fixbundle update actionpack
RubyGems/actionpack
Introduced in: 7.1.0Fixed in: 7.1.5.1
Fixbundle update actionpack
RubyGems/actionpack
Introduced in: 7.2.0Fixed in: 7.2.2.1
Fixbundle update actionpack
RubyGems/actionpack
Introduced in: 8.0.0Fixed in: 8.0.0.1
Fixbundle update actionpack

References