Ruby on Rails Multiple Cross Site Scripting Filter Security Bypass Weaknesses

Bugtraq ID:	48169
Class:	Input Validation Error
CVE:	CVE-2011-2197
Remote:	Yes
Local:	No
Published:	Jun 08 2011 12:00AM
Updated:	May 07 2015 05:06PM
Credit:	Bruno Michel of LinuxFr.org; Brett Valantine
Vulnerable:	Ruby on Rails Ruby on Rails 3.0.6 Ruby on Rails Ruby on Rails 3.0.5 Ruby on Rails Ruby on Rails 3.0.4 Ruby on Rails Ruby on Rails 3.0.3 Ruby on Rails Ruby on Rails 3.0.2 Ruby on Rails Ruby on Rails 3.0.1 Ruby on Rails Ruby on Rails 3.0 Ruby on Rails Ruby on Rails 2.3.11 Ruby on Rails Ruby on Rails 2.3.10 Ruby on Rails Ruby on Rails 2.3.9 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails 2.3.2 Ruby on Rails Ruby on Rails 2.2.3 Ruby on Rails Ruby on Rails 2.2.2 Ruby on Rails Ruby on Rails 2.1.1 Ruby on Rails Ruby on Rails 2.1 Ruby on Rails Ruby on Rails 2.0.5 Ruby on Rails Ruby on Rails 2.0.4 Ruby on Rails Ruby on Rails 2.0 Ruby on Rails Ruby on Rails 3.0.7
Not Vulnerable:	Ruby on Rails Ruby on Rails 3.0.8 Ruby on Rails Ruby on Rails 2.3.12

Ruby on Rails Multiple Cross Site Scripting Filter Security Bypass Weaknesses

Ruby on Rails is prone to multiple security-bypass weaknesses because it fails to properly mark certain strings as 'HTML safe'.

An attacker can exploit these issues to bypass cross-site scripting filter protections. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.

Versions prior to Ruby on Rails 3.0.8 and 2.3.12 are vulnerable.

Ruby on Rails Multiple Cross Site Scripting Filter Security Bypass Weaknesses

An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

Ruby on Rails Multiple Cross Site Scripting Filter Security Bypass Weaknesses

Solution:
Updates are available; please see the references for more information.

Ruby on Rails Multiple Cross Site Scripting Filter Security Bypass Weaknesses

References:

• Bug 713692 - (CVE-2011-2197) CVE-2011-2197 rubygem-activesupport: XSS due improp (RedHat)
  
• Potential XSS Vulnerability in Ruby on Rails Applications (Aaron Patterson)
  
• Ruby on Rails Homepage (Ruby on Rails)