Cross-site scripting in ActionView - CVE-2020-5267

Vulnerability identifier: #VU26248

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2020-5267

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "j" and "escape_javascript" methods . A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

ActionView
Opensuse
Fedora
rubygem-image_processing
rubygem-actioncable
rubygem-railties
rubygem-rails
rubygem-activesupport
rubygem-activestorage
rubygem-activerecord
rubygem-activemodel
rubygem-activejob
rubygem-actionview
rubygem-actiontext
rubygem-actionmailer
rubygem-actionmailbox
rubygem-actionpack

Install updates from vendor's website.

ActionView - addressed in versions 5.2.4.2, 6.0.2.2
rubygem-image_processing - update to 1.11.0-1.fc33
rubygem-actioncable - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-railties - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-rails - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activesupport - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activestorage - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activerecord - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activemodel - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activejob - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actionview - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actiontext - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actionmailer - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actionmailbox - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actionpack - addressed in versions 6.0.3.3-2.fc33, 6.0.3.3-2.fc34

• Exploit #2888 - legacy-rails-CVE-2020-5267-patch (Patch CVE-2020-5267 for Rails 4 and Rails 3) (June 3, 2020)

• http://www.openwall.com/lists/oss-security/2020/03/19/1
• https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a
• https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv
• https://lists.debian.org/debian-lts-announce/2020/03/msg00022.html

• Cross-site scripting in ActionView framework for Ruby on Rails
• OpenSUSE Linux update for rubygem-actionview-5_1
• Fedora 34 update for rubygem-actioncable, rubygem-actionmailbox, rubygem-actionmailer, rubygem-actionpack, rubygem-actiontext, rubygem-actionview, rubygem-activejob, rubygem-activemodel, rubygem-activerecord, rubygem-activestorage, rubygem-activesupport,
• Fedora 33 update for rubygem-actioncable, rubygem-actionmailbox, rubygem-actionmailer, rubygem-actionpack, rubygem-actiontext, rubygem-actionview, rubygem-activejob, rubygem-activemodel, rubygem-activerecord, rubygem-activestorage, rubygem-activesupport,