Ruby on Rails Multple Cross Site Scripting Vulnerabilities

http://www.securityfocus.com/bid/52264

Security Info

Bugtraq ID:	52264
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 02 2012 12:00AM
Updated:	Mar 02 2012 12:00AM
Credit:	Akira Matsuda and Sergey Nartimov
Vulnerable:	Ruby on Rails Ruby on Rails 3.1.2 Ruby on Rails Ruby on Rails 3.0.11 Ruby on Rails Ruby on Rails 3.0.6 Ruby on Rails Ruby on Rails 3.0.5 Ruby on Rails Ruby on Rails 3.0.4 Ruby on Rails Ruby on Rails 3.0.3 Ruby on Rails Ruby on Rails 3.0.3 Ruby on Rails Ruby on Rails 3.0.2 Ruby on Rails Ruby on Rails 3.0.1 Ruby on Rails Ruby on Rails 3.0 Ruby on Rails Ruby on Rails 2.3.11 Ruby on Rails Ruby on Rails 2.3.10 Ruby on Rails Ruby on Rails 2.3.9 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails 2.3.2 Ruby on Rails Ruby on Rails 2.2.3 Ruby on Rails Ruby on Rails 2.2.2 Ruby on Rails Ruby on Rails 2.1.1 Ruby on Rails Ruby on Rails 2.1 Ruby on Rails Ruby on Rails 2.0.5 Ruby on Rails Ruby on Rails 2.0.4 Ruby on Rails Ruby on Rails 2.0 Ruby on Rails Ruby on Rails 1.2.6 Ruby on Rails Ruby on Rails 1.2.5 Ruby on Rails Ruby on Rails 1.2.3 Ruby on Rails Ruby on Rails 1.1.6 Ruby on Rails Ruby on Rails 1.1.5 Ruby on Rails Ruby on Rails 1.1.4 Ruby on Rails Ruby on Rails 1.1.3 Ruby on Rails Ruby on Rails 1.1.2 Ruby on Rails Ruby on Rails 1.1.1 Ruby on Rails Ruby on Rails 1.1 Ruby on Rails Ruby on Rails 3.1.0.rc6 Ruby on Rails Ruby on Rails 3.1.0.rc5 Ruby on Rails Ruby on Rails 3.0.8 Ruby on Rails Ruby on Rails 3.0.7 Ruby on Rails Ruby on Rails 3.0.10 Ruby on Rails Ruby on Rails 2.3.13 Ruby on Rails Ruby on Rails 2.3.12 Ruby on Rails Ruby on Rails 1.0 Ruby on Rails Ruby on Rails 0.14 Ruby on Rails Ruby on Rails 0.13

Not Vulnerable:	Ruby on Rails Ruby on Rails 3.2.2 Ruby on Rails Ruby on Rails 3.1.4 Ruby on Rails Ruby on Rails 3.0.12

Security Discussion

Ruby on Rails is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Ruby on Rails versions prior to 3.2.2, 3.1.4, and 3.0.12 are vulnerable.

Proof of Concept and Security Exploits

To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.

Security Solution(s)

Solution:
Updates are available. Please see the references for more information.

Security References(s)

References:

Bug 406547 - dev-ruby/rails : XSS vulnerabilities (Gentoo)
Bug 799275 - rubygem-actionpack: XSS in SafeBuffer#[] (unescaped safe buffers ca (Red Hat)
Possible XSS Security Vulnerability in SafeBuffer#[] (Google)
Ruby on Rails Home Page (Ruby on Rails)

Emagined Security Blog featuring Dr. Eugene Schultz

Secure Web Programming
by Vizual Services