Ruby on Rails Cross Site Scripting and Cross Request Forgery Vulnerabilities

Bugtraq ID:	46291
Class:	Input Validation Error
CVE:	CVE-2011-0446 CVE-2011-0447
Remote:	Yes
Local:	No
Published:	Feb 09 2011 12:00AM
Updated:	Apr 16 2015 06:07PM
Credit:	Brendan Coles, IT Security Solutions and Rick Olson, Github and Felix Gröbert, Google Security Team
Vulnerable:	Ruby on Rails Ruby on Rails 3.0.1 Ruby on Rails Ruby on Rails 3.0 Ruby on Rails Ruby on Rails 2.3.10 Ruby on Rails Ruby on Rails 2.3.9 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails 2.3.2 Ruby on Rails Ruby on Rails 2.2.3 Ruby on Rails Ruby on Rails 2.2.2 Ruby on Rails Ruby on Rails 2.1.1 Ruby on Rails Ruby on Rails 2.1 Ruby on Rails Ruby on Rails 2.0.5 Ruby on Rails Ruby on Rails 2.0.4 Ruby on Rails Ruby on Rails 2.0 Ruby on Rails Ruby on Rails 1.2.6 Ruby on Rails Ruby on Rails 1.2.5 Ruby on Rails Ruby on Rails 1.2.3 Ruby on Rails Ruby on Rails 1.1.6 Ruby on Rails Ruby on Rails 1.1.5 Ruby on Rails Ruby on Rails 1.1.4 Ruby on Rails Ruby on Rails 1.1.3 Ruby on Rails Ruby on Rails 1.1.2 Ruby on Rails Ruby on Rails 1.1.1 Ruby on Rails Ruby on Rails 1.1 Ruby on Rails Ruby on Rails 1.0 Ruby on Rails Ruby on Rails 0.14 Ruby on Rails Ruby on Rails 0.13 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Ruby on Rails Ruby on Rails 3.0.4 Ruby on Rails Ruby on Rails 2.3.11

Ruby on Rails Cross Site Scripting and Cross Request Forgery Vulnerabilities

Ruby on Rails is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The attacker can exploit the cross-site request-forgery issue by tricking a victim into following a specially crafted HTTP request designed to perform some action on the attacker's behalf using the victim's currently active session.

Ruby on Rails Cross Site Scripting and Cross Request Forgery Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.

Ruby on Rails Cross Site Scripting and Cross Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Ruby on Rails Cross Site Scripting and Cross Request Forgery Vulnerabilities

References:

• CSRF Protection Bypass in Ruby on Rails (Ruby on Rails)
  
• Potential XSS Problem with mail_to :encode => :javascript (Ruby on Rails)
  
• Ruby on Rails Home Page (Ruby on Rails)