CVE-2023-49090: CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS
First published: Wed Nov 29 2023(Updated: )
### Impact [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. In addition, by setting the Content-Type configured by the attacker at the time of file delivery, it is possible to cause XSS on the user's browser when the uploaded file is opened. ### Patches Upgrade to [3.0.5](https://rubygems.org/gems/carrierwave/versions/3.0.5) or [2.2.5](https://rubygems.org/gems/carrierwave/versions/2.2.5). ### Workarounds When validating with `allowlisted_content_type?` in [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) , forward match(`\A`) the Content-Type set in `content_type_allowlist`, preventing unintentional permission of `text/html;image/png` when you want to allow only `image/png` in `content_type_allowlist`. ### References [OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html#content-type-validation)
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/carrierwave | <2.2.5 | 2.2.5 |
| rubygems/carrierwave | >=3.0.0<3.0.5 | 3.0.5 |
| Carrierwave | <2.2.5 | |
| Carrierwave | >=3.0.0<3.0.5 | |
| debian/ruby-carrierwave | <=1.3.2-2 |
Remedy
https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5
Remedy
https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj
- https://nvd.nist.gov/vuln/detail/CVE-2023-49090
- https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5
- https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3
- https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb
- https://rubygems.org/gems/carrierwave/versions/2.2.5
- https://rubygems.org/gems/carrierwave/versions/3.0.5
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2023-49090.yml
- https://github.com/advisories/GHSA-gxhx-g4fq-49hj (Advisory)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49090
- https://launchpad.net/bugs/cve/CVE-2023-49090
- https://security-tracker.debian.org/tracker/CVE-2023-49090
- https://ubuntu.com/security/CVE-2023-49090
Frequently Asked Questions
What is the impact of CVE-2023-49090?
CVE-2023-49090 has a Content-Type allowlist bypass vulnerability, possibly leading to XSS.
What is the severity of CVE-2023-49090?
CVE-2023-49090 has a severity score of 6.8 (medium).
Which software is affected by CVE-2023-49090?
CarrierWave versions up to 2.2.5 and versions between 3.0.0 and 3.0.5 are affected by CVE-2023-49090.
How can I fix CVE-2023-49090?
To fix CVE-2023-49090, you should update CarrierWave to version 2.2.6 or 3.0.6, which contain the necessary security fixes.
Where can I find more information about CVE-2023-49090?
You can find more information about CVE-2023-49090 in the following references: [GitHub Security Advisory](https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj), [Commit 39b282d](https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5), [Commit 863d425](https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3).
- collector/github-advisory-latest
- alias/GHSA-gxhx-g4fq-49hj
- alias/CVE-2023-49090
- collector/github-advisory
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/title
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/trending
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/author
- collector/usn-cve
- source/Ubuntu
- collector/launchpad-cve
- source/Launchpad
- agent/references
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- agent/source
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- package-manager/rubygems
- vendor/carrierwave project
- canonical/carrierwave
- version/carrierwave/3.0.0
- package-manager/debian