Ruby on Rails (often called Rails) is a web application framework written in Ruby that emphasizes convention over configuration and the principle of "don't repeat yourself" (DRY). It provides developers with a structured and efficient way to build database-backed web applications through pre-built patterns for rapid development.
This exploit allows a malicious attacker to execute system resources (“denial of service”) via a regular-expression exploit.
The Open Web Application Security Project (OWASP) explains that denial of service (DoS) attacks aim to make a service “unavailable for the purpose it was designed.”
Details
Module Info
- Product: Ruby on Rails Framework
- Affected packages: actionview
- GitHub repository:
https://github.com/rails/rails/tree/main/actionview - Published package: The individual actionview gem or the entire Rails Framework gem (which includes actionview).
- Package manager: gem
Vulnerability Info
Steps to Reproduce
1. Install a version of Rails that contains this vulnerability, such as 3.2.18:
gem install rails -v 3.2.18
rails _3.2.18_ new cve_test_app
cd cve_test_app
bundle install
2. Create a vulnerable controller:
rails generate controller Home index
3. Implement vulnerable code in app/controllers/home_controller.rb:
class HomeController < ApplicationController
def index
redirect_to params[:url] if params[:url].present?
end
end
4. Configure the route in config/routes.rb, ensure the root path is set:
Rails.application.routes.draw do
root "home#index"
end
5. Start the server:
rails server
6. Send a carefully crafted URL:
curl -i "http://localhost:3000/?url=%0Ajavascript:alert(1)"
7. Observe the behavior:
• If the app redirects to javascript:alert(1), it is vulnerable.
• Some browsers may block the redirect, but older versions or certain contexts might allow it.
Addressing the Issue
Although upgrading Rails is the best way to address this issue, upgrading to Ruby 3.2 is another viable option because it prevents this type of exploit.
Credits
Mitigation
Users of affected versions of Ruby on Rails should follow one of the following mitigations:
- Upgrade to a corrected version.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
