PT-2023-31049 · Unknown+3 · Carrierwave+3

A-Zara-N + 1 · Published 2023-11-29 · Updated 2025-11-07 · CVE-2023-49090

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CarrierWave versions prior to 2.2.5 CarrierWave versions prior to 3.0.5

Description The issue is related to a Content-Type allowlist bypass vulnerability in CarrierWave, which could lead to XSS attacks. The allowlisted content type? function performs a partial match to determine Content-Type permissions, allowing an attacker to bypass the allowlist by crafting a specific content type argument. This could enable the attacker to upload files with Content-Types not included in the content type allowlist, potentially causing XSS when the uploaded file is opened.

Recommendations For versions prior to 2.2.5, upgrade to version 2.2.5. For versions prior to 3.0.5, upgrade to version 3.0.5. As a temporary workaround, consider modifying the allowlisted content type? function to perform a forward match (A) of the Content-Type set in content type allowlist, preventing unintentional permission of unwanted Content-Types.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-49090

GHSA-GXHX-G4FQ-49HJ

USN-7497-1

Affected Products

Carrierwave

Debian

Linuxmint

Ubuntu

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49090.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2023-49090.yml · Exploit
• https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5 · Patch
• https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3 · Patch
• https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7497-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-49090 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49090 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49090 · Security Note
• https://osv.dev/vulnerability/USN-7497-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gxhx-g4fq-49hj · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-49090 · Security Note
• https://ubuntu.com/security/CVE-2023-49090 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49090 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21305 · Vendor Advisory