PT-2024-19402 · Avo · Avo

Stevegeek · Published 2024-01-16 · Updated 2024-01-24 · CVE-2024-22411

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Avo versions prior to 2.47.0 Avo versions prior to 3.3.0

Description Avo is a framework to create admin panels for Ruby on Rails apps. In Avo, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this to trigger a cross-site scripting attack on an unsuspecting user.

Recommendations For versions prior to 2.47.0, upgrade to version 2.47.0 or later. For versions prior to 3.3.0, upgrade to version 3.3.0 or later. As a temporary workaround, consider disabling the error and succeed methods in Avo::BaseAction subclasses until a patch is available. Restrict access to the Avo::BaseAction subclass to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-22411

GHSA-G8VP-2V5P-9QFH

Affected Products

Avo

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22411.json · Exploit
• 🔥 https://github.com/avo-hq/avo/security/advisories/GHSA-g8vp-2v5p-9qfh · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2024-22411.yml · Exploit
• https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347 · Patch
• https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-22411 · Security Note
• https://osv.dev/vulnerability/GHSA-g8vp-2v5p-9qfh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22411 · Vendor Advisory
• https://github.com/avo-hq/avo · Note
• https://github.com/avo-hq/avo/releases/tag/v2.47.0 · Note
• https://github.com/avo-hq/avo/releases/tag/v3.3.0 · Note
• https://twitter.com/VulmonFeeds/status/1747403980769014141 · Twitter Post
• https://twitter.com/CVEnew/status/1747386034353041468 · Twitter Post
• https://twitter.com/rubylandnews/status/1748047662308303010 · Twitter Post