CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
30.7%
RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute.
The issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.
Upgrade to 3.1.4. The vulnerability itself was patched in 3.1.3 but it has a functionality issue.
Initially the vulnerability was thought to exist in versions before 3.0, but it didn’t. 2.x users can stay on 2.2.1.
app/views/rails_admin/main/index.html.erb
) from the RailsAdmin version you use, and place it into your application by using the same path. <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>
<% value = property.pretty_value %>
- <td>
+ <%= content_tag(:td, class: [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?), title: strip_tags(value.to_s)) do %>
<%= value %>
- </td>
+ <% end %>
<% end %>
Note: The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can’t upgrade RailsAdmin now for a reason.
https://owasp.org/www-community/attacks/xss/
https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags
Vendor | Product | Version | CPE |
---|---|---|---|
rails_admin_project | rails_admin | * | cpe:2.3:a:rails_admin_project:rails_admin:*:*:*:*:*:ruby:*:* |
github.com/advisories/GHSA-8qgm-g2vv-vwvc
github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef
github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673
github.com/railsadminteam/rails_admin/issues/3686
github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc
github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_admin/CVE-2024-39308.yml
nvd.nist.gov/vuln/detail/CVE-2024-39308
rubygems.org/gems/rails_admin/versions/2.3.0
rubygems.org/gems/rails_admin/versions/3.1.3
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
30.7%