CVE-2024-39308: Rails admin Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8qgm-g2vv-vwvc",
  "modified" : "2024-07-11T20:24:10Z",
  "published" : "2024-07-08T14:14:43Z",
  "aliases" : [ "CVE-2024-39308" ],
  "summary" : "RailsAdmin Cross-site Scripting vulnerability in the list view",
  "details" : "### Impact\nRailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute.\nThe issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.\n\n### Patches\nUpgrade to [3.1.4](https://rubygems.org/gems/rails_admin/versions/3.1.4). The vulnerability itself was patched in 3.1.3 but it has a functionality issue.\nInitially the vulnerability was thought to exist in versions before 3.0, but it didn't. 2.x users can stay on 2.2.1.\n\n### Workarounds\n1. Copy the index view (located under the path `app/views/rails_admin/main/index.html.erb`) from the RailsAdmin version you use, and place it into your application by using the same path.\n2. Open the view file by an editor, and change the way to populate the td tag:\n\n```diff\n               <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>\n                 <% value = property.pretty_value %>\n-                <td class=\"<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>\" title=\"<%= value %>\">\n+                <%= content_tag(:td, class: [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?), title: strip_tags(value.to_s)) do %>\n                   <%= value %>\n-                </td>\n+                <% end %>\n               <% end %>\n```\n\n**Note:** The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can't upgrade RailsAdmin now for a reason.\n\n### References\nhttps://owasp.org/www-community/attacks/xss/\nhttps://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "rails_admin"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0.beta"
      }, {
        "fixed" : "3.1.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-39308"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/railsadminteam/rails_admin/issues/3686"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/railsadminteam/rails_admin"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_admin/CVE-2024-39308.yml"
  }, {
    "type" : "WEB",
    "url" : "https://rubygems.org/gems/rails_admin/versions/2.3.0"
  }, {
    "type" : "WEB",
    "url" : "https://rubygems.org/gems/rails_admin/versions/3.1.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-07-08T14:14:43Z",
    "nvd_published_at" : "2024-07-08T15:15:22Z"
  }
}