Cross-site scripting in actionpack
GHSA-35mm-cc6r-8fjp · CVE-2020-8264
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Workarounds
Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: config.middleware.delete ActionDispatch::ActionableExceptions
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-8264
- WEB https://hackerone.com/reports/904059
- WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8264.yml
- WEB https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk
- WEB https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
Ready to move
Start Securing
Free, no credit card | First findings in minutes