PT-2023-22811 · Pay · Pay

P- · Published 2023-04-19 · Updated 2023-05-15 · CVE-2023-30614

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Pay versions prior to 6.3.2

Description A payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. The back parameter is not properly sanitized, allowing an attacker to exploit this issue.

Recommendations For Pay versions prior to 6.3.2, upgrade to version 6.3.2 or above to patch the vulnerability. As a temporary workaround, consider restricting access to the payments info page until the issue is resolved. Additionally, restrict the use of the back parameter to only permit relative paths.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-30614

GHSA-CQF3-VPX7-RXHW

Affected Products

Pay

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30614.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pay/CVE-2023-30614.yml · Exploit
• https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f · Patch
• https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30614 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30614 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cqf3-vpx7-rxhw · Vendor Advisory
• https://github.com/pay-rails/pay/commit/c067771d8c7514acde4b948b474caf054bb0e25d · Note
• https://github.com/pay-rails/pay · Note
• https://t.me/cvenotify/49534 · Telegram Post
• https://t.me/cibsecurity/62474 · Telegram Post
• https://t.me/cvenotify/50493 · Telegram Post