CVE-2012-1099: XSS
A cross-site scripting (XSS) flaw was found in the way 'select' helper method of the Ruby on Rails performed HTML escaping of 'select' HTML tag options, when the tags were created manually. In this case, the select tag values might end up unescaped. A remote-attacker could provide a specially-crafted input to Ruby on Rails application, using select tags this way, which potentially resulted into arbitrary HTML or webscript execution.
References: [1] http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released [2] http://groups.google.com/group/rubyonrails-security/browsethread/thread/9da0c515a6c4664 [3] https://bugs.gentoo.org/showbug.cgi?id=406547
Proposed upstream patches: [4] http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-0-selectoptions.patch?part=3 (against v3.0 branch) [5] http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-1-selectoptions.patch?part=4 (against v3.1 branch) [6] http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-2-selectoptions.patch?part=5 (against v3.2 branch)
Other sources
Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/formoptionshelper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/formoptionshelper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1099?
CVE-2012-1099 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2012-1099?
To fix CVE-2012-1099, upgrade your Ruby on Rails application to the patched versions 3.0.12, 3.1.4, or 3.2.2.
Which versions of Ruby on Rails are affected by CVE-2012-1099?
CVE-2012-1099 affects Ruby on Rails versions 3.0.0 to 3.0.11, and 3.1.0 to 3.1.3.
What causes the vulnerability in CVE-2012-1099?
The vulnerability in CVE-2012-1099 is caused by improper HTML escaping in the 'select' helper method when options are created manually.
Is there a workaround for CVE-2012-1099 before applying patches?
There are no recommended workarounds for CVE-2012-1099; applying the available patches is strongly advised.