JVN#83881261: Ruby on Rails library Paperclip vulnerable to cross-site scripting

Paperclip provided by thoughtbot is a library to upload files in Ruby on Rails. Paperclip contains a persistent cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to t...

FreeBSD : rubygem-rails -- multiple vulnerabilities (eb8a8978-8dd5-49ce-87f4-49667b2166dd)

Ruby on Rails blog : Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

rubygem-actionmailer: email address processing DoS

Multiple format string vulnerabilities in logsubscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message...

Moderate: Red Hat Bug Fix Advisory: CFME 5.4.0 bug fixes, and enhancement update

Updated cfme packages that fix several bugs, and add various enhancements are now available for Red Hat CloudForms 3.2. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engin...

CSRF Vulnerability in jquery-rails

In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to " https://attacker.com" note the leading space that will be passed to JQuery, who will s...

Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution

This module exploits an IP whitelist bypass vulnerability in the developer web console included with Ruby on Rails 4.0.x and 4.1.x. This module will also achieve code execution on Rails 4.2.x if the attack is launched from a whitelisted IP range. Module Options msf use...

Possible Denial of Service attack in Active Support

Specially crafted XML documents can cause applications to raise a SystemStackError and potentially cause a denial of service attack. This only impacts applications using REXML or JDOM as their XML processor. Other XML processors that Rails supports are not impacted. All users running an affected...

XSS Vulnerability in ActiveSupport::JSON.encode

When a Hash containing user-controlled data is encode as JSON either through Hashtojson or ActiveSupport::JSON.encode, Rails does not perform adequate escaping that matches the guarantee implied by the escapehtmlentitiesinjson option which is enabled by default. If this resulting JSON string is...

IP whitelist bypass in Web Console

Specially crafted remote requests can spoof their origin, bypassing the IP whitelist, in any environment where Web Console is enabled development and test, by default. Users whose application is only accessible from localhost as is the default behaviour in Rails 4.2 are not affected, unless a loc...

rubygem-rails -- multiple vulnerabilities

Ruby on Rails blog: Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2...

Ruby on Rails 4.0.x/4.1.x/4.2.x (Web Console v2) - Whitelist Bypass Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Ruby on Rails Web Console v2 Whitelist Bypass Code Execution', 'Description' = %q This module exploits an IP whitelist bypass...

CSRF vulnerability in OmniAuth's request phase

The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site Request Forgery CSRF when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into...

Ruby on Rails: Changeable model ids on vanilla update can lead to severely bad side-effects

Proof of concept User.find1.update!id: 1701 But strong params! Disagree. There are cases where less experienced users will allow "id" as a param for a subnested resource and then copy and past that code into that subnested resource's own controller, forgetting to remove the "id". I consider this...

Hulihan Applications Amethyst HTML Injection Vulnerability

Hulihan Applications Amethyst is a U.S. Hulihan Applications, Inc. based on Ruby on Rails a set of open-source Web application framework based on the Ruby language of the open-source blog application . An HTML injection vulnerability exists in Hulihan Applications Amethyst, which stems from the...

Hulihan Applications Onyx Cross-Site Scripting Vulnerability

Hulihan Applications Onyx is a U.S. Hulihan Applications company based on Ruby on Rails a set of open source Web application framework based on the Ruby language of the open source image library , which provides customized themes , image uploads and image effects and other features . A cross-site...

Raritan PowerIQ 4.1 / 4.2 / 4.3 Code Execution

Raritan PowerIQ versions 4.1, 4.2, and 4.3 ship with a Rails 2 web interface with a hardcoded session secret of 8e238c9702412d475a4c44b7726a0537. This can be used to achieve unauthenticated remote code execution as the nginx user on vulnerable systems. msf exploitrailssecretdeserialization show...

Ruby on Rails ActiveModel::Name Remote Denial of Service Vulnerability

Ruby on Rails is a web application framework , built on top of the Ruby language . A security vulnerability in Rails ActiveModel::Name allows an attacker to send specially crafted data to an application, causing tojson to call ActiveModel::Name, which can cause the application to cause a dead loo...

Ruby on Rails 'to_json' Call Remote Denial of Service Vulnerability

Ruby on Rails Rails is the Rails core team to develop and maintain a set of open source Web application framework based on the Ruby language . A denial of service vulnerability exists in Ruby on Rails. A remote attacker can exploit this vulnerability to cause a denial of service...

HackerOne: Reflected File Download attack allows attacker to 'upload' executables to hackerone.com domain

Hi hackerone team, I'm a friend of Peiying and am looking for a position at hackerone. While playing around with your product, I found a serious vulnerability in your application: it allows attackers to craft executables on the hackerone.com domain rather than the sandboxed one on S3. 1. attacker...

Ruby on Rails: rails-ujs will send CSRF tokens to other origins

I reported this via email a few months ago. Here was my initial email: Hello, I've been playing with getting Rails apps to send CSRF tokens to the wrong domains and I found a few problems. The main motivation for this is in attacking a site that uses Content Security Policy. With CSP enabled, an...