PT-2024-25017 · Phlex · Phlex

Joeldrapper · Published 2024-04-30 · Updated 2024-05-02 · CVE-2024-32970

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Phlex versions prior to the patched versions available on RubyGems

Description The issue is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. This occurs because the escapes were working as designed but did not account for how permissive browsers are when executing unsafe JavaScript via HTML attributes. If a user-provided link is used in an <a> tag's href attribute, it could execute JavaScript when clicked. Similarly, if user-provided attributes are used when rendering HTML or SVG tags, malicious event attributes could be included, executing JavaScript when events are triggered. The project now exercises every possible attack vector, including enumerating every ASCII character, and runs tests in Chrome, Firefox, and Safari. Additionally, tests are conducted against a list of 6613 known XSS payloads.

Recommendations For all affected versions of Phlex, users are advised to upgrade to a patched version available on RubyGems. As a temporary workaround for users unable to upgrade, configure a Content Security Policy that does not allow unsafe-inline to prevent exploitation. For users who upgrade, it is also recommended to configure a Content Security Policy header that does not allow unsafe-inline.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-32970

GHSA-9P57-H987-4VGX

Affected Products

Phlex

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32970.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32970.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32970 · Security Note
• https://osv.dev/vulnerability/GHSA-9p57-h987-4vgx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32970 · Vendor Advisory
• https://github.com/payloadbox/xss-payload-list · Note
• https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2 · Note
• https://github.com/phlex-ruby/phlex · Note
• https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx · Note
• https://rubygems.org/gems/phlex/versions/1.9.3 · Note
• https://twitter.com/VulmonFeeds/status/1785471476742676784 · Twitter Post
• https://twitter.com/rubylandnews/status/1786173946959728817 · Twitter Post
• https://rubygems.org/gems/phlex/versions/1.10.2 · Note
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy · Note
• https://twitter.com/cracbot/status/1785612328160940443 · Twitter Post