Vulnerabilities > CVE-2013-1855 - Cross-site Scripting vulnerability in multiple products

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Vulnerable Configurations

Part Description Count
Application
Rubyonrails
221
OS
Redhat
1

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Embedding Scripts in Non-Script Elements
    This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Cross-Site Scripting in Error Pages
    An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
  • Cross-Site Scripting Using Alternate Syntax
    The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-324.NASL
    descriptionChanges in rubygem-actionpack-2_3 : - add 2 patches to fix security issues : - bug-809935_2-3-css_sanitize.patch: CVE-2013-1855: rubygem-actionpack*: XSS vulnerability in sanitize_css in Action Pack (bnc#809935) - bug-809940_2-3-sanitize_protocol.patch: CVE-2013-1857: rubygem-actionpack*: XSS Vulnerability in the `sanitize` helper of Ruby on Rails (bnc#809940)
    last seen2020-06-05
    modified2014-06-13
    plugin id74968
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74968
    titleopenSUSE Security Update : rubygem-actionpack-2_3 (openSUSE-SU-2013:0662-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2013-324.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74968);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2013-1855", "CVE-2013-1857");
    
      script_name(english:"openSUSE Security Update : rubygem-actionpack-2_3 (openSUSE-SU-2013:0662-1)");
      script_summary(english:"Check for the openSUSE-2013-324 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Changes in rubygem-actionpack-2_3 :
    
      - add 2 patches to fix security issues :
    
      - bug-809935_2-3-css_sanitize.patch: CVE-2013-1855:
        rubygem-actionpack*: XSS vulnerability in sanitize_css
        in Action Pack (bnc#809935)
    
      - bug-809940_2-3-sanitize_protocol.patch: CVE-2013-1857:
        rubygem-actionpack*: XSS Vulnerability in the `sanitize`
        helper of Ruby on Rails (bnc#809940)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=809935"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=809940"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected rubygem-actionpack-2_3 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:rubygem-actionpack-2_3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:rubygem-actionpack-2_3-testsuite");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2013/04/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.1|SUSE12\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1 / 12.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.1", reference:"rubygem-actionpack-2_3-2.3.17-3.24.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"rubygem-actionpack-2_3-testsuite-2.3.17-3.24.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"rubygem-actionpack-2_3-2.3.17-2.21.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"rubygem-actionpack-2_3-testsuite-2.3.17-2.21.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rubygem-actionpack-2_3 / rubygem-actionpack-2_3-testsuite");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2655.NASL
    descriptionSeveral cross-site-scripting and denial of service vulnerabilities were discovered in Ruby on Rails, a Ruby framework for web application development.
    last seen2020-03-17
    modified2013-03-29
    plugin id65727
    published2013-03-29
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/65727
    titleDebian DSA-2655-1 : rails - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-2655. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(65727);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2011-2932", "CVE-2012-3464", "CVE-2012-3465", "CVE-2013-1854", "CVE-2013-1855", "CVE-2013-1857");
      script_bugtraq_id(54957, 54958, 58549, 58552, 58555);
      script_xref(name:"DSA", value:"2655");
    
      script_name(english:"Debian DSA-2655-1 : rails - several vulnerabilities");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several cross-site-scripting and denial of service vulnerabilities
    were discovered in Ruby on Rails, a Ruby framework for web application
    development."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/squeeze/rails"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2013/dsa-2655"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the rails packages.
    
    For the stable distribution (squeeze), these problems have been fixed
    in version 2.3.5-1.2+squeeze8."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:rails");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2013/03/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/03/29");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"6.0", prefix:"libactionmailer-ruby", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactionmailer-ruby1.8", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactionpack-ruby", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactionpack-ruby1.8", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactiverecord-ruby", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactiverecord-ruby1.8", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactiverecord-ruby1.9.1", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactiveresource-ruby", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactiveresource-ruby1.8", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactivesupport-ruby", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactivesupport-ruby1.8", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"libactivesupport-ruby1.9.1", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"rails", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"rails-doc", reference:"2.3.5-1.2+squeeze8")) flag++;
    if (deb_check(release:"6.0", prefix:"rails-ruby1.8", reference:"2.3.5-1.2+squeeze8")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SERVER_3_0.NASL
    descriptionThe remote Mac OS X host has a version of OS X Server installed that is prior to 3.0. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in the included JSON Ruby Gem, which can be abused to exhaust all available memory resources. (CVE-2013-0269) - Multiple cross-site scripting vulnerabilities exist in the included Ruby on Rails software. (CVE-2013-1854 / CVE-2013-1855 / CVE-2013-1856 / CVE-2013-1857) - A buffer overflow exists in the included FreeRADIUS software that can be triggered when parsing the
    last seen2020-06-01
    modified2020-06-02
    plugin id70590
    published2013-10-24
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/70590
    titleMac OS X : OS X Server < 3.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include("compat.inc");
    
    
    if (description)
    {
      script_id(70590);
      script_version("1.5");
      script_cvs_date("Date: 2018/07/14  1:59:36");
    
      script_cve_id(
        "CVE-2012-3547",
        "CVE-2013-0269",
        "CVE-2013-1854",
        "CVE-2013-1855",
        "CVE-2013-1856",
        "CVE-2013-1857",
        "CVE-2013-5143"
      );
      script_bugtraq_id(55483, 57899, 58549, 58552, 58554, 58555, 63285);
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2013-10-22-5");
    
      script_name(english:"Mac OS X : OS X Server < 3.0 Multiple Vulnerabilities");
      script_summary(english:"Checks OS X Server version.");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote host is missing a security update for OS X Server."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "The remote Mac OS X host has a version of OS X Server installed that
    is prior to 3.0. It is, therefore, affected by the following
    vulnerabilities :
    
      - A denial of service vulnerability exists in the
        included JSON Ruby Gem, which can be abused to exhaust
        all available memory resources. (CVE-2013-0269)
    
      - Multiple cross-site scripting vulnerabilities exist in
        the included Ruby on Rails software. (CVE-2013-1854 /
        CVE-2013-1855 / CVE-2013-1856 / CVE-2013-1857)
    
      - A buffer overflow exists in the included FreeRADIUS
        software that can be triggered when parsing the 'not
        after' timestamp in a client certificate when using
        TLS-based EAP methods. (CVE-2012-3547)
    
      - A logic issue exists whereby the RADIUS service could
        choose an incorrect certificate from a list of
        configured certificates."
      );
      script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT5999");
      script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html");
      script_set_attribute(attribute:"solution", value:"Upgrade to Mac OS X Server version 3.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/09/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2013/10/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/10/24");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:mac_os_x_server");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.");
    
      script_dependencies("macosx_server_services.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "MacOSX/Server/Version");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    os = get_kb_item("Host/MacOSX/Version");
    if (!os) audit(AUDIT_OS_NOT, "Mac OS X");
    
    version = get_kb_item_or_exit("MacOSX/Server/Version");
    
    fixed_version = "3.0";
    if (
      ereg(pattern:"Mac OS X 10\.[0-6]([^0-9]|$)", string:os) ||
      ver_compare(ver:version, fix:fixed_version, strict:FALSE) == -1
    )
    {
      set_kb_item(name:"www/0/XSS", value:TRUE);
    
      if (report_verbosity > 0)
      {
        report =
          '\n  Installed version : ' + version +
          '\n  Fixed version     : ' + fixed_version + '\n';
        security_hole(port:0, extra:report);
      }
      else security_hole(0);
    }
    else audit(AUDIT_INST_VER_NOT_VULN, "OS X Server", version);
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201412-28.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201412-28 (Ruby on Rails: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could execute arbitrary code or cause a Denial of Service condition. Furthermore, a remote attacker may be able to execute arbitrary SQL commands, change parameter names for form inputs and make changes to arbitrary records in the system, bypass intended access restrictions, render arbitrary views, inject arbitrary web script or HTML, or conduct cross-site request forgery (CSRF) attacks. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id79981
    published2014-12-15
    reporterThis script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79981
    titleGLSA-201412-28 : Ruby on Rails: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201412-28.
    #
    # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(79981);
      script_version("1.4");
      script_cvs_date("Date: 2018/12/05 20:31:22");
    
      script_cve_id("CVE-2010-3933", "CVE-2011-0446", "CVE-2011-0447", "CVE-2011-0448", "CVE-2011-0449", "CVE-2011-2929", "CVE-2011-2930", "CVE-2011-2931", "CVE-2011-2932", "CVE-2011-3186", "CVE-2013-0155", "CVE-2013-0156", "CVE-2013-0276", "CVE-2013-0277", "CVE-2013-0333", "CVE-2013-1854", "CVE-2013-1855", "CVE-2013-1856", "CVE-2013-1857");
      script_bugtraq_id(44124, 46291, 46292, 49179, 57187, 57192, 57575, 57896, 57898, 58549, 58552, 58554, 58555);
      script_xref(name:"GLSA", value:"201412-28");
    
      script_name(english:"GLSA-201412-28 : Ruby on Rails: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201412-28
    (Ruby on Rails: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in Ruby on Rails. Please
          review the CVE identifiers referenced below for details.
      
    Impact :
    
        A remote attacker could execute arbitrary code or cause a Denial of
          Service condition. Furthermore, a remote attacker may be able to execute
          arbitrary SQL commands, change parameter names for form inputs and make
          changes to arbitrary records in the system, bypass intended access
          restrictions, render arbitrary views, inject arbitrary web script or
          HTML, or conduct cross-site request forgery (CSRF) attacks.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201412-28"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Ruby on Rails 2.x users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-ruby/rails-2.3.18'
        NOTE: All applications using Ruby on Rails should also be configured to
          use the latest version available by running &ldquo;rake rails:update&rdquo;
          inside the application directory.
        NOTE: This is a legacy GLSA and stable updates for Ruby on Rails,
          including the unaffected version listed above, are no longer available
          from Gentoo. It may be possible to upgrade to the 3.2, 4.0, or 4.1
          branches, however these packages are not currently stable."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Ruby on Rails JSON Processor YAML Deserialization Code Execution');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:rails");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2014/12/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/12/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-ruby/rails", unaffected:make_list("ge 2.3.18"), vulnerable:make_list("lt 2.3.18"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Ruby on Rails");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-329.NASL
    descriptionChanges in rubygem-actionpack-3_2 : - add 2 patches to fix security issues : - bug-809935_3-2-css_sanitize.patch: CVE-2013-1855: rubygem-actionpack*: XSS vulnerability in sanitize_css in Action Pack (bnc#809935) - bug-809940_3-2-sanitize_protocol.patch: CVE-2013-1857: rubygem-actionpack*: XSS Vulnerability in the `sanitize` helper of Ruby on Rails (bnc#809940)
    last seen2020-06-05
    modified2014-06-13
    plugin id74972
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74972
    titleopenSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2013:0661-1)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_DB0C4B00A24C11E29601000D601460A4.NASL
    descriptionRuby on Rails team reports : Rails versions 3.2.13 has been released. This release contains important security fixes. It is recommended users upgrade as soon as possible. Four vulnerabilities have been discovered and fixed : - (CVE-2013-1854) Symbol DoS vulnerability in Active Record - (CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack - (CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users - (CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails
    last seen2020-06-01
    modified2020-06-02
    plugin id65937
    published2013-04-12
    reporterThis script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/65937
    titleFreeBSD : rubygem-rails -- multiple vulnerabilities (db0c4b00-a24c-11e2-9601-000d601460a4)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-1863.NASL
    descriptionUpdated Subscription Asset Manager 1.4 packages that fix multiple security issues are now available. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Red Hat Subscription Asset Manager acts as a proxy for handling subscription information and software updates on client machines. Red Hat Subscription Asset Manager is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components. A directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted request. (CVE-2014-0130) A flaw was found in the way Ruby on Rails handled hashes in certain queries. A remote attacker could use this flaw to perform a denial of service (resource consumption) attack by sending specially crafted queries that would result in the creation of Ruby symbols, which were never garbage collected. (CVE-2013-1854) Two cross-site scripting (XSS) flaws were found in Action Pack. A remote attacker could use these flaws to conduct XSS attacks against users of an application using Action Pack. (CVE-2013-1855, CVE-2013-1857) It was discovered that the internationalization component of Ruby on Rails could, under certain circumstances, return a fallback HTML string that contained user input. A remote attacker could possibly use this flaw to perform a reflective cross-site scripting (XSS) attack by providing a specially crafted input to an application using the aforementioned component. (CVE-2013-4491) A denial of service flaw was found in the header handling component of Action View. A remote attacker could send strings in specially crafted headers that would be cached indefinitely, which would result in all available system memory eventually being consumed. (CVE-2013-6414) It was found that the number_to_currency Action View helper did not properly escape the unit parameter. An attacker could use this flaw to perform a cross-site scripting (XSS) attack on an application that uses data submitted by a user in the unit parameter. (CVE-2013-6415) Red Hat would like to thank Ruby on Rails upstream for reporting these issues. Upstream acknowledges Ben Murphy as the original reporter of CVE-2013-1854, Charlie Somerville as the original reporter of CVE-2013-1855, Alan Jenkins as the original reporter of CVE-2013-1857, Peter McLarnan as the original reporter of CVE-2013-4491, Toby Hsieh as the original reporter of CVE-2013-6414, and Ankit Gupta as the original reporter of CVE-2013-6415. All Subscription Asset Manager users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id79326
    published2014-11-19
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79326
    titleRHEL 6 : Subscription Asset Manager (RHSA-2014:1863)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2013-002.NASL
    descriptionThe remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-002 applied. This update contains numerous security-related fixes for the following components : - CoreMedia Playback (10.7 only) - Directory Service (10.6 only) - OpenSSL - QuickDraw Manager - QuickTime - Ruby (10.6 only) - SMB (10.7 only)
    last seen2020-06-01
    modified2020-06-02
    plugin id66809
    published2013-06-05
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66809
    titleMac OS X Multiple Vulnerabilities (Security Update 2013-002)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2013-0698.NASL
    descriptionUpdated rubygem-actionpack and ruby193-rubygem-actionpack packages that fix two security issues are now available for Red Hat OpenShift Enterprise 1.1.3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components. Two cross-site scripting (XSS) flaws were found in rubygem-actionpack and ruby193-rubygem-actionpack. A remote attacker could use these flaws to conduct XSS attacks against users of an application using rubygem-actionpack or ruby193-rubygem-actionpack. (CVE-2013-1855, CVE-2013-1857) Red Hat would like to thank Ruby on Rails upstream for reporting these issues. Upstream acknowledges Charlie Somerville as the original reporter of CVE-2013-1855, and Alan Jenkins as the original reporter of CVE-2013-1857. Users of Red Hat OpenShift Enterprise 1.1.3 are advised to upgrade to these updated packages, which correct these issues.
    last seen2020-06-10
    modified2018-12-06
    plugin id119434
    published2018-12-06
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119434
    titleRHEL 6 : rubygem-actionpack and ruby193-rubygem-actionpack (RHSA-2013:0698)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-4199.NASL
    descriptionFix for CVE-2013-1855 and CVE-2013-1857. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-04-01
    plugin id65752
    published2013-04-01
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/65752
    titleFedora 17 : rubygem-actionpack-3.0.11-9.fc17 (2013-4199)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-4214.NASL
    descriptionFix for CVE-2013-1855 and CVE-2013-1857. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-04-01
    plugin id65755
    published2013-04-01
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/65755
    titleFedora 18 : rubygem-actionpack-3.2.8-3.fc18 (2013-4214)

Redhat

advisories
  • rhsa
    idRHSA-2013:0698
  • rhsa
    idRHSA-2014:1863
rpms
  • ruby193-rubygem-actionpack-1:3.2.8-5.el6
  • ruby193-rubygem-actionpack-doc-1:3.2.8-5.el6
  • rubygem-actionpack-1:3.0.13-8.el6op
  • katello-common-0:1.4.3.28-1.el6sam_splice
  • katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice
  • katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice
  • katello-headpin-0:1.4.3.28-1.el6sam_splice
  • katello-headpin-all-0:1.4.3.28-1.el6sam_splice
  • ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam
  • ruby193-rubygem-actionpack-1:3.2.17-6.el6sam
  • ruby193-rubygem-activemodel-1:3.2.17-1.el6sam
  • ruby193-rubygem-activerecord-1:3.2.17-5.el6sam
  • ruby193-rubygem-activeresource-1:3.2.17-1.el6sam
  • ruby193-rubygem-activesupport-1:3.2.17-2.el6sam
  • ruby193-rubygem-i18n-0:0.6.9-1.el6sam
  • ruby193-rubygem-mail-0:2.5.4-1.el6sam
  • ruby193-rubygem-rack-1:1.4.5-3.el6sam
  • ruby193-rubygem-rails-1:3.2.17-1.el6sam
  • ruby193-rubygem-railties-1:3.2.17-1.el6sam

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 58552 CVE(CAN) ID: CVE-2013-1855 Ruby on Rails简称RoR或Rails,是一个使用Ruby语言写的开源Web应用框架,它是严格按照MVC结构开发的。 Ruby on Rails 2.3.18, 3.1.12, 3.2.13之前版本在Action Pack内的sanitize_css中存在XSS漏洞,特制的文本可以绕过sanitize_css方法提供的过滤,攻击者可利用此漏洞在浏览器中执行任意脚本代码。 0 Ruby on Rails 3.x Ruby on Rails 2.x 临时解决方法: 如果您不能立刻安装补丁或者升级,建议您采取以下措施以降低威胁: *应用下面的monkey patch: ``` module HTML class WhiteListSanitizer # Sanitizes a block of css code. Used by #sanitize when it comes across a style attribute def sanitize_css(style) # disallow urls style = style.to_s.gsub(/url\s*\(\s*[^\s)]+?\s*\)\s*/, ' ') # gauntlet if style !~ /\A([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\&quot;[\s\w]+\&quot;|\([\d,\s]+\))*\z/ || style !~ /\A(\s*[-\w]+\s*:\s*[^:;]*(;|$)\s*)*\z/ return '' end clean = [] style.scan(/([-\w]+)\s*:\s*([^:;]*)/) do |prop,val| if allowed_css_properties.include?(prop.downcase) clean &lt;&lt; prop + ': ' + val + ';' elsif shorthand_css_properties.include?(prop.split('-')[0].downcase) unless val.split().any? do |keyword| !allowed_css_keywords.include?(keyword) &amp;&amp; keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/ end clean &lt;&lt; prop + ': ' + val + ';' end end end clean.join(' ') end end end ``` 厂商补丁: Ruby on Rails ------------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.rubyonrails.com/ http://seclists.org/oss-sec/2013/q1/att-679/2-3-css_sanitize.patch http://seclists.org/oss-sec/2013/q1/att-679/3-0-css_sanitize.patch http://seclists.org/oss-sec/2013/q1/att-679/3-1-css_sanitize.patch http://seclists.org/oss-sec/2013/q1/att-679/3-2-css_sanitize.patch
idSSV:60695
last seen2017-11-19
modified2013-03-20
published2013-03-20
reporterRoot
titleRuby on Rails 'sanitize_css()'方法跨站脚本漏洞(CVE-2013-1855)