CVE-2024-54133
published 2024-12-10CVE-2024-54133: Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the…
PriorityP413low2.3CVSS 4.0
AVNACLATPPRNUIPVCNVINVANSCLSILSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
1.01%
59.2th percentile
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 5.2.0 < 7.0.8.7 | 7.0.8.7 |
| actionpack_project | actionpack | >= 7.1.0 < 7.1.5.1 | 7.1.5.1 |
| actionpack_project | actionpack | >= 7.2.0 < 7.2.2.1 | 7.2.2.1 |
| actionpack_project | actionpack | >= 8.0.0 < 8.0.0.1 | 8.0.0.1 |
| debian | rails | < rails 2:6.1.7.10+dfsg-1~deb12u1 (bookworm) | rails 2:6.1.7.10+dfsg-1~deb12u1 (bookworm) |
| rails | rails | — | — |
| rails | rails | — | — |
| rails | rails | — | — |
| rails | rails | — | — |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-2+deb11u3 | 2:6.0.3.7+dfsg-2+deb11u3 |
| rubyonrails | rails | >= 0 < 2:6.1.7.10+dfsg-1~deb12u1 | 2:6.1.7.10+dfsg-1~deb12u1 |
| rubyonrails | rails | >= 0 < 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
CVSS provenance
nvdv4.02.3LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.3LOW
vendor_debian2.3LOW
vendor_redhat2.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Possible Content Security Policy bypass in Action Dispatch
ghsa·2024-12-10
CVE-2024-54133 [LOW] CWE-79 Possible Content Security Policy bypass in Action Dispatch
Possible Content Security Policy bypass in Action Dispatch
There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack.
Impact
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.
Releases
The fixed releases are available at the normal locations.
Workarounds
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Credits
Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
OSV
CVE-2024-54133: Action Pack is a framework for handling and responding to web requests
osv·2024-12-10·CVSS 2.3
CVE-2024-54133 [LOW] CVE-2024-54133: Action Pack is a framework for handling and responding to web requests
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
OSV
Possible Content Security Policy bypass in Action Dispatch
osv·2024-12-10
CVE-2024-54133 [LOW] Possible Content Security Policy bypass in Action Dispatch
Possible Content Security Policy bypass in Action Dispatch
There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack.
Impact
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.
Releases
The fixed releases are available at the normal locations.
Workarounds
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Credits
Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
Red Hat
actionpack: Possible Content Security Policy bypass in Action Dispatch
vendor_redhat·2024-12-10·CVSS 2.3
CVE-2024-54133 [LOW] CWE-79 actionpack: Possible Content Security Policy bypass in Action Dispatch
actionpack: Possible Content Security Policy bypass in Action Dispatch
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can vali
Debian
CVE-2024-54133: rails - Action Pack is a framework for handling and responding to web requests. There is...
vendor_debian·2024·CVSS 2.3
CVE-2024-54133 [LOW] CVE-2024-54133: rails - Action Pack is a framework for handling and responding to web requests. There is...
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Scope: local
bookworm: resolved (fixed in 2:6.
No detection rules found.
No public exploits indexed.
https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3ahttps://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1dhttps://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26vhttps://security.netapp.com/advisory/ntap-20250306-0010/
2024-12-10
Published