CVE-2024-28103: Action Pack is missing security headers on non-HTML responses
Permissions-Policy is Only Served on HTML Content-Type
The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type.
This has been assigned the CVE identifier CVE-2024-28103.
Versions Affected: >= 6.1.0 Not affected: < 6.1.0 Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4
Impact ------ Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.
Releases -------- The fixed releases are available at the normal locations.
Workarounds ----------- N/A
Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy regarding security issues. They are in git-am format and consist of a single changeset.
6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series
Credits -------
Thank you shinkbr for reporting this!
Other sources
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28103?
CVE-2024-28103 is considered a moderate severity vulnerability due to its limited exposure based on content types.
How do I fix CVE-2024-28103?
To fix CVE-2024-28103, upgrade the actionpack gem to version 7.2.0.beta2 or apply one of the specified remedial versions.
What versions are affected by CVE-2024-28103?
CVE-2024-28103 affects actionpack versions greater than or equal to 6.1.0.
Can system configurations mitigate CVE-2024-28103?
No, system configurations cannot mitigate CVE-2024-28103; upgrading to a safe version is required.
What types of applications are affected by CVE-2024-28103?
Applications using Ruby on Rails actionpack versions 6.1.0 and above are affected by CVE-2024-28103.