PT-2022-15536 · Ruby On Rails+2 · Action Pack+2

Thorsteneckel · Published 2022-04-27 · Updated 2023-03-14 · CVE-2022-22577

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Action Pack versions 5.2.0 through 5.2.7 Action Pack versions 6.0.0 through 6.0.4.7 Action Pack versions 6.1.0 through 6.1.5.0 Action Pack versions 7.0.0 through 7.0.2.3

Description The issue allows an attacker to bypass Content Security Policy (CSP) for non-HTML responses, potentially exposing users to cross-site scripting (XSS) attacks. This occurs because CSP headers were only sent with responses considered as "HTML" by Rails, leaving API requests without these headers.

Recommendations For Action Pack version 5.2.7 and earlier, update to version 5.2.7.1. For Action Pack version 6.0.4.7 and earlier, update to version 6.0.4.8. For Action Pack version 6.1.5.0 and earlier, update to version 6.1.5.1. For Action Pack version 7.0.2.3 and earlier, update to version 7.0.2.4. As a temporary workaround, consider setting a CSP for API responses manually until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-22577

DLA-3093-1

DSA-5372-1

GHSA-MM33-5VFQ-3MM3

RHSA-2023:2097

RLSA-2023:2097

Affected Products

Action Pack

Astra Linux

Rocky Linux

References · 25

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-22577.yml · Exploit
• https://debian.org/security/2023/dsa-5372 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:2097 · Vendor Advisory
• https://discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-22577 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22577 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mm33-5vfq-3mm3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-22577 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-22577 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22577 · Security Note
• https://osv.dev/vulnerability/DLA-3093-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22577 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5372-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-22577 · Vendor Advisory
• https://github.com/rails/rails · Note