CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54133.json"
}

References

Affected packages

Git / github.com/rails/rails

Affected ranges

Type

GIT

Repo

https://github.com/rails/rails

Events

Introduced

375a4143cf5caeb6159b338be824903edfd62836

Fixed

778eab826538be6da355d848aecaea2245e3b8ce

Introduced

d39db5d1891f7509cde2efc425c9d69bbb77e670

Fixed

14c115b120ed089331ff3dc13f36bd9129ced33d

Introduced

fb6c4305939da06efdf2893d99130e7829c53e8b

Fixed

33beb0a38db1c058123a8e3cc298cad918adfe32

Introduced

dd8f7185faeca6ee968a6e9367f6d8601a83b8db

Fixed

a993c27a50395e727872600b5669976ff0a272e7

Fixed

2e3f41e4538b9ca1044357f6644f037bbb7c6c49

Fixed

3da2479cfe1e00177114b17e496213c40d286b3a

Fixed

5558e72f22fc69c1c407b31ac5fb3b4ce087b542

Fixed

cb16a3bb515b5d769f73926d9757270ace691f1d

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "5.2.0"
                },
                {
                    "fixed": "7.0.8.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "7.1.0"
                },
                {
                    "fixed": "7.1.5.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "7.2.0"
                },
                {
                    "fixed": "7.2.2.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.0.0.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "2e3f41e4538b9ca1044357f6644f037bbb7c6c49"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "3da2479cfe1e00177114b17e496213c40d286b3a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "5558e72f22fc69c1c407b31ac5fb3b4ce087b542"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "cb16a3bb515b5d769f73926d9757270ace691f1d"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v7.*

v7.1.0

v7.1.1

v7.1.2

v7.1.3

v7.1.4

v7.1.5

v8.*

v8.0.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-54133.json"