Cross-site scripting in YARD - CVE-2024-27285

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed to the frames.erb template. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Affected software

How to mitigate CVE-2024-27285

External References

• https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
• https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
• https://github.com/lsegal/yard/pull/1538
• https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
• https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/

Related Security Bulletins

• Cross-site scripting in YARD
• Fedora 38 update for rubygem-yard
• openEuler update for rubygem-yard
• Debian update for yard