Internet Bug Bounty · Report #2905532
[CVE-2024-54133] Possible Content Security Policy bypass in Action Dispatch
Summary
There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper in Action Pack.
- CVE-2024-54133
- GHSA-vfm5-rmrh-j26v
Versions affected
- actionpack >= 5.2.0, < 7.0.8.7 (patched in 7.0.8.7)
- actionpack >= 7.1.0, < 7.1.5.1 (patched in 7.1.5.1)
- actionpack >= 7.2.0, < 7.2.2.1 (patched in 7.2.2.1)
- actionpack >= 8.0.0, < 8.0.0.1 (patched in 8.0.0.1)
Impact Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.
How it was found
Summary
Original report: https://hackerone.com/reports/2440762 Advisory: https://discuss.rubyonrails.org/t/cve-2024-54133-possible-content-security-policy-bypass-in-action-dispatch/88178
Impact
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.