CVE-2020-8264
published 2021-01-06CVE-2020-8264: In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in…
PriorityP344medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
70.72%
99.3th percentile
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 6.0.0 < 6.0.3.4 | 6.0.3.4 |
| debian | rails | < rails 2:6.0.3.4+dfsg-1 (bookworm) | rails 2:6.0.3.4+dfsg-1 (bookworm) |
| https | github.com_rails_rails | — | — |
| rubyonrails | rails | >= 0 < 2:6.0.3.4+dfsg-1 | 2:6.0.3.4+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.4+dfsg-1 | 2:6.0.3.4+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.4+dfsg-1 | 2:6.0.3.4+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.4+dfsg-1 | 2:6.0.3.4+dfsg-1 |
| rubyonrails | rails | >= 6.0.0 < 6.0.3.4 | 6.0.3.4 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability exists only when the Rails application is running in development mode; production-mode deployments are not affected ↗
- →The vulnerable component is the Actionable Exceptions middleware in the actionpack gem; monitor/alert on requests hitting this middleware in dev-mode Rails apps ↗
- →Affected versions are actionpack gem >= 6.0.0; fixed in Debian package version 2:6.0.3.4+dfsg-1 ↗
- ·This vulnerability only affects Rails applications running in development mode; production-mode deployments are explicitly not affected ↗
- ·Scope is local — the attacker must be able to send a crafted URL to a developer running the app locally, or embed it in another page the developer visits ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rubygem-actionpack: possible XSS vulnerability in Action Pack in development mode
vendor_redhat·2020-10-07·CVSS 6.1
CVE-2020-8264 [MEDIUM] CWE-79 rubygem-actionpack: possible XSS vulnerability in Action Pack in development mode
rubygem-actionpack: possible XSS vulnerability in Action Pack in development mode
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
A flaw was found in rubygem-actionpack. A XSS vulnerability in Action Pack's Actionable Exceptions middleware while the application server is in development mode is possible. The highest threat from this vulnerability is to data confidentiality and integrity.
Statement: Red Hat products ships rubygem-actionpack, however, those are supposed to be run in production
Debian
CVE-2020-8264: rails - In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an applicat...
vendor_debian·2020·CVSS 6.1
CVE-2020-8264 [MEDIUM] CVE-2020-8264: rails - In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an applicat...
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Scope: local
bookworm: resolved (fixed in 2:6.0.3.4+dfsg-1)
bullseye: resolved (fixed in 2:6.0.3.4+dfsg-1)
forky: resolved (fixed in 2:6.0.3.4+dfsg-1)
sid: resolved (fixed in 2:6.0.3.4+dfsg-1)
trixie: resolved (fixed in 2:6.0.3.4+dfsg-1)
OSV
Cross-site scripting in actionpack
osv·2021-04-07
CVE-2020-8264 [MEDIUM] Cross-site scripting in actionpack
Cross-site scripting in actionpack
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Workarounds
Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: `config.middleware.delete ActionDispatch::ActionableExceptions`
GHSA
Cross-site scripting in actionpack
ghsa·2021-04-07
CVE-2020-8264 [MEDIUM] CWE-79 Cross-site scripting in actionpack
Cross-site scripting in actionpack
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Workarounds
Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: `config.middleware.delete ActionDispatch::ActionableExceptions`
OSV
CVE-2020-8264: In actionpack gem >= 6
osv·2021-01-06·CVSS 6.1
CVE-2020-8264 [MEDIUM] CVE-2020-8264: In actionpack gem >= 6
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
No detection rules found.
No public exploits indexed.
2021-01-06
Published