CVE-2024-27285
published 2024-02-28CVE-2024-27285: YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.06%
60.7th percentile
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | yard | < yard 0.9.28-2+deb12u2 (bookworm) | yard 0.9.28-2+deb12u2 (bookworm) |
| fedoraproject | fedora | — | — |
| lsegal | yard | < 0.9.36 | 0.9.36 |
| yardoc | yard | < 0.9.36 | 0.9.36 |
| yardoc | yard | >= 0 < 0.9.24-1+deb11u1 | 0.9.24-1+deb11u1 |
| yardoc | yard | >= 0 < 0.9.28-2+deb12u2 | 0.9.28-2+deb12u2 |
| yardoc | yard | >= 0 < 0.9.36-1 | 0.9.36-1 |
| yardoc | yard | >= 0 < 0.9.36-1 | 0.9.36-1 |
| yardoc | yard | >= 0 < 0.9.36 | 0.9.36 |
| yardoc | yard | >= 0 < 0.9.24-1+deb11u1build0.20.04.1 | 0.9.24-1+deb11u1build0.20.04.1 |
| yardoc | yard | >= 0 < 0.9.26-1ubuntu0.1 | 0.9.26-1ubuntu0.1 |
| yardoc | yard | >= 0 < 0.8.7.6+git20160220-3ubuntu0.1~esm1 | 0.8.7.6+git20160220-3ubuntu0.1~esm1 |
| yardoc | yard | >= 0 < 0.9.12-2ubuntu0.1~esm1 | 0.9.12-2ubuntu0.1~esm1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
yard vulnerabilities
osv·2024-04-15·CVSS 7.5
CVE-2017-17042 [HIGH] yard vulnerabilities
yard vulnerabilities
It was discovered that YARD before 0.9.11 does not block relative paths
with an initial ../ sequence, which allows attackers to conduct
directory traversal attacks and read arbitrary files. This issue only
affected Ubuntu 16.04 LTS. (CVE-2017-17042)
It was discovered that yard before 0.9.20 is affected by a path
traversal vulnerability, allowing HTTP requests to access arbitrary
files under certain conditions. This issue only affected Ubuntu 18.04
LTS. (CVE-2019-1020001)
Aviv Keller discovered that the "frames.html" file within the Yard
Doc's generated documentation is vulnerable to Cross-Site Scripting
(XSS) attacks due to inadequate sanitization of user input within the
JavaScript segment of the "frames.erb" template file. (CVE-2024-27285)
OSV
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
osv·2024-02-28
CVE-2024-27285 [MEDIUM] YARD's default template vulnerable to Cross-site Scripting in generated frames.html
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
### Summary
The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.
### Details
The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.
Snippet from "frames.erb":
(v0.9.34)
```erb
var match =
GHSA
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
ghsa·2024-02-28
CVE-2024-27285 [MEDIUM] CWE-79 YARD's default template vulnerable to Cross-site Scripting in generated frames.html
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
### Summary
The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.
### Details
The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the "frames.erb" template file. Specifically, the script lacks proper sanitization of the hash data before utilizing it to establish the top-level window's location. This oversight permits an attacker to inject malicious JavaScript payloads through carefully crafted URLs.
Snippet from "frames.erb":
(v0.9.34)
```erb
var match =
OSV
CVE-2024-27285: YARD is a Ruby Documentation tool
osv·2024-02-28·CVSS 6.1
CVE-2024-27285 [MEDIUM] CVE-2024-27285: YARD is a Ruby Documentation tool
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.
Ubuntu
YARD vulnerabilities
vendor_ubuntu·2024-04-15·CVSS 7.5
CVE-2017-17042 [HIGH] YARD vulnerabilities
Title: YARD vulnerabilities
Summary: Several security issues were fixed in yard.
It was discovered that YARD before 0.9.11 does not block relative paths
with an initial ../ sequence, which allows attackers to conduct
directory traversal attacks and read arbitrary files. This issue only
affected Ubuntu 16.04 LTS. (CVE-2017-17042)
It was discovered that yard before 0.9.20 is affected by a path
traversal vulnerability, allowing HTTP requests to access arbitrary
files under certain conditions. This issue only affected Ubuntu 18.04
LTS. (CVE-2019-1020001)
Aviv Keller discovered that the "frames.html" file within the Yard
Doc's generated documentation is vulnerable to Cross-Site Scripting
(XSS) attacks due to inadequate sanitization of user input within the
JavaScript segment of the "frames.
Red Hat
yard: Cross-site scripting in the frams.erb template file
vendor_redhat·2024-02-28·CVSS 5.4
CVE-2024-27285 [MEDIUM] CWE-79 yard: Cross-site scripting in the frams.erb template file
yard: Cross-site scripting in the frams.erb template file
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.
A flaw was found in the YARD Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.
Package: puppet-dns (Red Hat OpenStack Platform 16.1) - Not affected
Package: puppet-dns (Red Hat OpenStack Platform 16.2) - Not affected
Package:
Debian
CVE-2024-27285: yard - YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's ...
vendor_debian·2024·CVSS 5.4
CVE-2024-27285 [MEDIUM] CVE-2024-27285: yard - YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's ...
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.
Scope: local
bookworm: resolved (fixed in 0.9.28-2+deb12u2)
bullseye: resolved (fixed in 0.9.24-1+deb11u1)
forky: resolved (fixed in 0.9.36-1)
sid: resolved (fixed in 0.9.36-1)
trixie: resolved (fixed in 0.9.36-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aahttps://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054behttps://github.com/lsegal/yard/pull/1538https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrchttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.ymlhttps://lists.debian.org/debian-lts-announce/2024/03/msg00006.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aahttps://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054behttps://github.com/lsegal/yard/pull/1538https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrchttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.ymlhttps://lists.debian.org/debian-lts-announce/2024/03/msg00006.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/
2024-02-28
Published