CVE-2023-28362
published 2025-01-09CVE-2023-28362: The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for…
PriorityP414medium4CVSS 3.1
AVLACLPRNUINSUCNILAN
EPSS
0.33%
25.4th percentile
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 0 < 6.1.7.4 | 6.1.7.4 |
| actionpack_project | actionpack | >= 7.0.0 < 7.0.5.1 | 7.0.5.1 |
| debian | rails | < rails 2:6.1.7.10+dfsg-1~deb12u1 (bookworm) | rails 2:6.1.7.10+dfsg-1~deb12u1 (bookworm) |
| rails | action_pack | >= 6.1.7.4 < 6.1.7.4 | 6.1.7.4 |
| rails | action_pack | >= 7.0.5.1 < 7.0.5.1 | 7.0.5.1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-2+deb11u3 | 2:6.0.3.7+dfsg-2+deb11u3 |
| rubyonrails | rails | >= 0 < 2:6.1.7.10+dfsg-1~deb12u1 | 2:6.1.7.10+dfsg-1~deb12u1 |
| rubyonrails | rails | >= 0 < 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
CVSS provenance
nvdv3.14.0MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ghsa4.0MEDIUM
osv4.0MEDIUM
vendor_debian4.0MEDIUM
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-28362: The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value
osv·2025-01-09·CVSS 4.0
CVE-2023-28362 [MEDIUM] CVE-2023-28362: The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
GHSA
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
ghsa·2023-06-29·CVSS 4.0
CVE-2023-28362 [MEDIUM] CWE-116 Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
The `redirect_to` method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362.
Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4
# Impact
This introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rai
OSV
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
osv·2023-06-29·CVSS 4.0
CVE-2023-28362 [MEDIUM] Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
The `redirect_to` method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362.
Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4
# Impact
This introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rai
Red Hat
actionpack: Possible XSS via User Supplied Values to redirect_to
vendor_redhat·2023-06-27·CVSS 4.0
CVE-2023-28362 [MEDIUM] CWE-79 actionpack: Possible XSS via User Supplied Values to redirect_to
actionpack: Possible XSS via User Supplied Values to redirect_to
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
A Cross-site Scripting (XSS) vulnerability was found in Actionpack due to improper sanitization of user-supplied values. This allows provided values to contain characters that are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned location header.
Package: 3scale-amp-system-container (Red Hat 3scale API Management Platform 2) - Will not fix
Pac
Debian
CVE-2023-28362: rails - The redirect_to method in Rails allows provided values to contain characters whi...
vendor_debian·2023·CVSS 4.0
CVE-2023-28362 [MEDIUM] CVE-2023-28362: rails - The redirect_to method in Rails allows provided values to contain characters whi...
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
Scope: local
bookworm: resolved (fixed in 2:6.1.7.10+dfsg-1~deb12u1)
bullseye: resolved (fixed in 2:6.0.3.7+dfsg-2+deb11u3)
forky: resolved (fixed in 2:7.2.2.1+dfsg-1)
sid: resolved (fixed in 2:7.2.2.1+dfsg-1)
trixie: resolved (fixed in 2:7.2.2.1+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132https://github.com/advisories/GHSA-4g8v-vg43-wpgfhttps://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5https://security.netapp.com/advisory/ntap-20250502-0009/
2025-01-09
Published