CVE-2024-26143: Rails Possible XSS Vulnerability in Action Controller
First published: Tue Feb 27 2024(Updated: )
# Possible XSS Vulnerability in Action Controller There is a possible XSS vulnerability when using the translation helpers (`translate`, `t`, etc) in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2024-26143. Versions Affected: >= 7.0.0. Not affected: < 7.0.0 Fixed Versions: 7.1.3.1, 7.0.8.1 Impact ------ Applications using translation methods like `translate`, or `t` on a controller, with a key ending in "_html", a `:default` key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. For example, impacted code will look something like this: ```ruby class ArticlesController < ApplicationController def show @message = t("message_html", default: untrusted_input) # The `show` template displays the contents of `@message` end end ``` To reiterate the pre-conditions, applications must: * Use a translation function from a controller (i.e. _not_ I18n.t, or `t` from a view) * Use a key that ends in `_html` * Use a default value where the default value is untrusted and unescaped input * Send the text to the victim (whether that's part of a template, or a `render` call) All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- There are no feasible workarounds for this issue. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 7-0-translate-xss.patch - Patch for 7.0 series * 7-1-translate-xss.patch - Patch for 7.1 series Credits ------- Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the patch and fix!
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/rails | >=7.1.0<7.1.3.1 | 7.1.3.1 |
| rubygems/rails | >=7.0.0<7.0.8.1 | 7.0.8.1 |
| rubygems/actionpack | >=7.1.0<7.1.3.1 | 7.1.3.1 |
| rubygems/actionpack | >=7.0.0<7.0.8.1 | 7.0.8.1 |
| Ruby on Rails | >=7.0.0<7.0.8.1 | |
| Ruby on Rails | >=7.1.0<7.1.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4
- https://nvd.nist.gov/vuln/detail/CVE-2024-26143
- https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc
- https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e
- https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.yml
- https://github.com/advisories/GHSA-9822-6m93-xqf4 (Advisory)
- https://security.netapp.com/advisory/ntap-20240510-0004/
- https://security.netapp.com/advisory/ntap-20240510-0004
Frequently Asked Questions
What is the CVSS score of CVE-2024-26143?
The CVSS score for CVE-2024-26143 is not explicitly stated in the available resources.
What versions are affected by CVE-2024-26143?
CVE-2024-26143 affects versions of Action Controller that are 7.0.0 and above.
How can I mitigate CVE-2024-26143?
To mitigate CVE-2024-26143, upgrade to Action Pack version 7.1.3.1 or 7.0.8.1.
Is CVE-2024-26143 a risk for my Rails application?
Yes, CVE-2024-26143 poses a potential XSS risk for applications using vulnerable versions of Action Controller.
What are the consequences of exploiting CVE-2024-26143?
Exploiting CVE-2024-26143 could allow an attacker to execute arbitrary JavaScript code in the context of a user's browser.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-9822-6m93-xqf4
- alias/CVE-2024-26143
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/references
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/remedy
- agent/last-modified-date
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/rubygems
- vendor/rubyonrails
- canonical/ruby on rails
- version/ruby on rails/7.0.0
- version/ruby on rails/7.1.0