CVE-2012-1098: XSS
A cross-site scripting (XSS) flaw was found in the way the String class, used in Ruby on Rails, performed HTML escaping of SafeBuffer objects, when such objects were manipulated directly via '[]' method or other methods, also returning new instances of SafeBuffer object. By using these methods, such newly returned SafeBuffer instances would be inadvertently marked as HTML safe. If a Ruby on Rails application used SafeBuffer objects this way, a remote attacker could provide a specially-crafted input, which once processed by such SafeBuffer instance would pass the HTML escaping test without further filtering, possibly leading to arbitrary HTML or webscript execution.
References: [1] http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released [2] http://groups.google.com/group/rubyonrails-security/browsethread/thread/edd28f1e3d04e913 [3] https://bugs.gentoo.org/showbug.cgi?id=406547
Proposed upstream patches: [4] http://groups.google.com/group/rubyonrails-security/attach/1c2e01a5e42722c9/3-0-safe-buffer-slice.patch?part=3 (against v3.0 branch) [5] http://groups.google.com/group/rubyonrails-security/attach/1c2e01a5e42722c9/3-1-safe-buffer-slice.patch?part=4 (against v3.1 branch) [6] http://groups.google.com/group/rubyonrails-security/attach/1c2e01a5e42722c9/3-2-safe-buffer-slice.patch?part=5 (against v3.2 branch)
Other sources
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1098?
CVE-2012-1098 has been classified as a medium severity vulnerability.
How do I fix CVE-2012-1098?
To fix CVE-2012-1098, update to the fixed versions of the affected package, specifically activesupport 3.0.12, 3.1.4, or 3.2.2.
What versions of Ruby on Rails are affected by CVE-2012-1098?
CVE-2012-1098 affects Ruby on Rails versions 3.0.0 to 3.0.11, 3.1.0 to 3.1.4, and 3.2.0 to 3.2.2.
What is the nature of the vulnerability CVE-2012-1098?
CVE-2012-1098 is a cross-site scripting (XSS) vulnerability due to improper HTML escaping of SafeBuffer objects in Ruby on Rails.
Can CVE-2012-1098 be exploited remotely?
Yes, CVE-2012-1098 can be exploited remotely through crafted input that triggers the XSS flaw.