Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay

GHSA-cqf3-vpx7-rxhw · CVE-2023-30614

Published Apr 20, 2023 · Modified Feb 16, 2024

Description

Impact

A payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality.

Patches

This has been patched in version 6.3.2 and above.

Pay will now sanitize the back parameter and only permit relative paths.

References

WEB https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-30614
WEB https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f
WEB https://github.com/pay-rails/pay/commit/c067771d8c7514acde4b948b474caf054bb0e25d
PACKAGE https://github.com/pay-rails/pay
WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pay/CVE-2023-30614.yml

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes