PT-2024-22333 · Phlex · Phlex

P8 · Published 2024-03-11 · Updated 2024-03-13 · CVE-2024-28199

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions phlex versions 1.0.0 through 1.9.0

Description phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. If you render an <a> tag with an href attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user. If you splat user-provided attributes when rendering any HTML tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user.

Recommendations For versions 1.0.0 through 1.9.0, upgrade to a patched version available on RubyGems. As a temporary workaround, consider configuring a content security policy that does not allow unsafe-inline. Restrict access to user-provided attributes and links to minimize the risk of exploitation. Avoid using user-provided data in HTML tags until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-28199

GHSA-242P-4V39-2V8G

Affected Products

Phlex

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28199.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-28199.yml · Exploit
• https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1 · Patch
• https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28199 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28199 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-242p-4v39-2v8g · Vendor Advisory
• https://github.com/phlex-ruby/phlex · Note
• https://twitter.com/cracbot/status/1767602888992317689 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1767347288995700763 · Twitter Post
• https://twitter.com/rubylandnews/status/1768084707638432214 · Twitter Post
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy · Note
• https://twitter.com/CVEnew/status/1767328623449563317 · Twitter Post
• https://twitter.com/it_malibu/status/1768106286670029083 · Twitter Post
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline · Note