CVE-2014-0081: XSS

Q: What is the severity of CVE-2014-0081?

CVE-2014-0081 is classified as a high severity vulnerability due to the potential for remote code execution through cross-site scripting (XSS).

Q: How do I fix CVE-2014-0081?

To fix CVE-2014-0081, you should upgrade Ruby on Rails to version 3.2.17, 4.0.3, or later versions to eliminate the vulnerabilities.

Q: What are the affected versions by CVE-2014-0081?

CVE-2014-0081 affects Ruby on Rails versions before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2.

Q: Who is impacted by CVE-2014-0081?

Any application using affected versions of Ruby on Rails is potentially vulnerable to remote attacks exploiting XSS.

Q: What types of vulnerabilities are associated with CVE-2014-0081?

CVE-2014-0081 involves multiple cross-site scripting (XSS) vulnerabilities allowing attackers to inject arbitrary web script or HTML.

Published Feb 20, 2014

Updated

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negativeformat, or (3) units parameter to the (a) numbertocurrency, (b) numbertopercentage, or (c) numbertohuman helper.

Other sources

There is an XSS vulnerability in the numbertocurrency, numbertopercentage and numbertohuman helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081.

Versions Affected: All. Fixed Versions: 4.1.0.beta2, 4.0.3, 3.2.17.

Impact ------ These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negativeformat and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack.

All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.

Releases -------- The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at the normal locations.

Workarounds -----------

The workaround for this issue is to escape the value passed to the parameter. For example, replace code like this:

ruby <%= numbertocurrency(1.02, format: params[:format]) %>

With code like this

ruby <%= numbertocurrency(1.02, format: h(params[:format])) %>

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

4-1-beta-numberhelpersxss.patch - Patch for 4.1-beta series 4-0-numberhelpersxss.patch - Patch for 4.0 series 3-2-numberhelpersxss.patch - Patch for 3.2 series

Please note that only the 4.0.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits -------

Thanks to Kevin Reintjes for reporting the issue to us.

-- Aaron Patterson http://tenderlovemaking.com/

Affected Software

190 affected componentsFixes available

rubygems/actionpack>=4.0.0<4.0.3

4.0.3

rubygems/actionpack>=3.0.0<3.2.17

3.2.17

rubygems/rails>=4.0.0<4.0.3

4.0.3

rubygems/rails>=3.0.0<3.2.17

3.2.17

rubyonrails Rails=0.9.1

rubyonrails Rails=0.9.2

rubyonrails Rails=0.9.3

rubyonrails Rails=0.9.4

rubyonrails Rails=0.9.4.1

rubyonrails Rails=0.10.0

rubyonrails Rails=0.10.1

rubyonrails Rails=0.11.0

rubyonrails Rails=0.11.1

rubyonrails Rails=0.12.0

rubyonrails Rails=0.12.1

rubyonrails Rails=0.13.0

rubyonrails Rails=0.13.1

rubyonrails Rails=0.14.1

rubyonrails Rails=0.14.2

rubyonrails Rails=0.14.3

rubyonrails Rails=0.14.4

rubyonrails Rails=1.0.0

rubyonrails Rails=1.1.0

rubyonrails Rails=1.1.1

rubyonrails Rails=1.1.2

rubyonrails Rails=1.1.3

rubyonrails Rails=1.1.4

rubyonrails Rails=1.1.5

rubyonrails Rails=1.1.6

rubyonrails Rails=1.2.0

rubyonrails Rails=1.2.1

rubyonrails Rails=1.2.2

rubyonrails Rails=1.2.3

rubyonrails Rails=1.2.4

rubyonrails Rails=1.2.5

rubyonrails Rails=1.2.6

rubyonrails Rails=1.9.5

rubyonrails Rails=2.0.0

rubyonrails Rails=2.0.0-rc1

rubyonrails Rails=2.0.0-rc2

rubyonrails Rails=2.0.1

rubyonrails Rails=2.0.2

rubyonrails Rails=2.0.4

rubyonrails Rails=2.1.0

rubyonrails Rails=2.1.1

rubyonrails Rails=2.1.2

rubyonrails Rails=2.2.0

rubyonrails Rails=2.2.1

rubyonrails Rails=2.2.2

rubyonrails Rails=2.3.0

rubyonrails Rails=2.3.1

rubyonrails Rails=2.3.2

rubyonrails Rails=2.3.3

rubyonrails Rails=2.3.4

rubyonrails Rails=2.3.9

rubyonrails Rails=2.3.10

rubyonrails Rails=2.3.11

rubyonrails Rails=2.3.12

rubyonrails Rails=2.3.13

rubyonrails Rails=2.3.14

rubyonrails Rails=2.3.15

rubyonrails Rails=2.3.16

rubyonrails Rails=3.0.0

rubyonrails Rails=3.0.0-beta

rubyonrails Rails=3.0.0-beta2

rubyonrails Rails=3.0.0-beta3

rubyonrails Rails=3.0.0-beta4

rubyonrails Rails=3.0.0-rc

rubyonrails Rails=3.0.0-rc2

rubyonrails Rails=3.0.1

rubyonrails Rails=3.0.1-pre

rubyonrails Rails=3.0.2

rubyonrails Rails=3.0.2-pre

rubyonrails Rails=3.0.3

rubyonrails Rails=3.0.4-rc1

rubyonrails Rails=3.0.5

rubyonrails Rails=3.0.5-rc1

rubyonrails Rails=3.0.6

rubyonrails Rails=3.0.6-rc1

rubyonrails Rails=3.0.6-rc2

rubyonrails Rails=3.0.7

rubyonrails Rails=3.0.7-rc1

rubyonrails Rails=3.0.7-rc2

rubyonrails Rails=3.0.8

rubyonrails Rails=3.0.8-rc1

rubyonrails Rails=3.0.8-rc2

rubyonrails Rails=3.0.8-rc3

rubyonrails Rails=3.0.8-rc4

rubyonrails Rails=3.0.9

rubyonrails Rails=3.0.9-rc1

rubyonrails Rails=3.0.9-rc2

rubyonrails Rails=3.0.9-rc3

rubyonrails Rails=3.0.9-rc4

rubyonrails Rails=3.0.9-rc5

rubyonrails Rails=3.0.10

rubyonrails Rails=3.0.10-rc1

rubyonrails Rails=3.0.11

rubyonrails Rails=3.0.12

rubyonrails Rails=3.0.12-rc1

rubyonrails Rails=3.0.13

rubyonrails Rails=3.0.13-rc1

rubyonrails Rails=3.0.14

rubyonrails Rails=3.0.16

rubyonrails Rails=3.0.17

rubyonrails Rails=3.0.18

rubyonrails Rails=3.0.19

rubyonrails Rails=3.0.20

rubyonrails Rails=3.1.0

rubyonrails Rails=3.1.0-beta1

rubyonrails Rails=3.1.0-rc1

rubyonrails Rails=3.1.0-rc2

rubyonrails Rails=3.1.0-rc3

rubyonrails Rails=3.1.0-rc4

rubyonrails Rails=3.1.0-rc5

rubyonrails Rails=3.1.0-rc6

rubyonrails Rails=3.1.0-rc7

rubyonrails Rails=3.1.0-rc8

rubyonrails Rails=3.1.1

rubyonrails Rails=3.1.1-rc1

rubyonrails Rails=3.1.1-rc2

rubyonrails Rails=3.1.1-rc3

rubyonrails Rails=3.1.2

rubyonrails Rails=3.1.2-rc1

rubyonrails Rails=3.1.2-rc2

rubyonrails Rails=3.1.3

rubyonrails Rails=3.1.4

rubyonrails Rails=3.1.4-rc1

rubyonrails Rails=3.1.5

rubyonrails Rails=3.1.5-rc1

rubyonrails Rails=3.1.6

rubyonrails Rails=3.1.7

rubyonrails Rails=3.1.8

rubyonrails Rails=3.1.9

rubyonrails Rails=3.1.10

rubyonrails Rails=3.2.0

rubyonrails Rails=3.2.0-rc1

rubyonrails Rails=3.2.0-rc2

rubyonrails Rails=3.2.1

rubyonrails Rails=3.2.2

rubyonrails Rails=3.2.2-rc1

rubyonrails Rails=3.2.3

rubyonrails Rails=3.2.3-rc1

rubyonrails Rails=3.2.3-rc2

rubyonrails Rails=3.2.4

rubyonrails Rails=3.2.4-rc1

rubyonrails Rails=3.2.5

rubyonrails Rails=3.2.6

rubyonrails Rails=3.2.7

rubyonrails Rails=3.2.8

rubyonrails Rails=3.2.9

rubyonrails Rails=3.2.10

rubyonrails Rails=3.2.11

rubyonrails Rails=3.2.12

rubyonrails Rails=3.2.13

rubyonrails Rails=3.2.13-rc1

rubyonrails Rails=3.2.13-rc2

rubyonrails Rails=3.2.15

rubyonrails Rails=3.2.15-rc3

rubyonrails Rails=4.0.0

rubyonrails Rails=4.0.0-beta

rubyonrails Rails=4.0.0-rc1

rubyonrails Rails=4.0.0-rc2

rubyonrails Rails=4.0.1

rubyonrails Rails=4.0.1-rc1

rubyonrails Rails=4.0.1-rc2

rubyonrails Rails=4.0.1-rc3

rubyonrails Rails=4.0.1-rc4

rubyonrails Rails=4.0.2

rubyonrails Rails=4.1.0-beta1

rubyonrails ruby on Rails<=3.2.16

rubyonrails ruby on Rails=0.5.0

rubyonrails ruby on Rails=0.5.5

rubyonrails ruby on Rails=0.5.6

rubyonrails ruby on Rails=0.5.7

rubyonrails ruby on Rails=0.6.0

rubyonrails ruby on Rails=0.6.5

rubyonrails ruby on Rails=0.7.0

rubyonrails ruby on Rails=0.8.0

rubyonrails ruby on Rails=0.8.5

rubyonrails ruby on Rails=0.9.0

rubyonrails ruby on Rails=3.0.4

rubyonrails ruby on Rails=3.2.14

rubyonrails ruby on Rails=3.2.14-rc1

rubyonrails ruby on Rails=3.2.14-rc2

rubyonrails ruby on Rails=3.2.15-rc1

rubyonrails ruby on Rails=3.2.15-rc2

openSUSE openSUSE=13.1

Opensuse Project Opensuse=12.3

redhat Cloudforms=3.0

redhat Enterprise Linux=6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 4.0.3
Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 3.2.17
Upgrade
Upgrade rubygems/rails to a version that resolves this vulnerability.
Fixed in 4.0.3
Upgrade
Upgrade rubygems/rails to a version that resolves this vulnerability.
Fixed in 3.2.17
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.0.beta2
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.3
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.17
Compensating control
Workaround if you cannot upgrade: escape the value passed to the number helper parameters (format, negative_format, units) for number_to_currency, number_to_percentage, and number_to_human in actionview/lib/action_view/helpers/number_helper.rb.

Event History

Feb 20, 2014

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Data Sourced

via NVD·03:27 PM

DescriptionSeverityWeaknessAffected Software

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2014-0081?

CVE-2014-0081 is classified as a high severity vulnerability due to the potential for remote code execution through cross-site scripting (XSS).

How do I fix CVE-2014-0081?

To fix CVE-2014-0081, you should upgrade Ruby on Rails to version 3.2.17, 4.0.3, or later versions to eliminate the vulnerabilities.

What are the affected versions by CVE-2014-0081?