Lucene search

GitHub Advisory DatabaseGHSA-FWHR-88QX-H9G7

HistoryJun 04, 2024 - 10:26 p.m.

Missing security headers in Action Pack on non-HTML responses

2024-06-0422:26:24

CWE-20

GitHub Advisory Database

github.com

action pack

permissions-policy

content-type

releases

patches

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

38.7%

JSON

Permissions-Policy is Only Served on HTML Content-Type

The application configurable Permissions-Policy is only served on responses
with an HTML related Content-Type.

This has been assigned the CVE identifier CVE-2024-28103.

Versions Affected: >= 6.1.0
Not affected: < 6.1.0
Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4

Impact

Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.

Releases

The fixed releases are available at the normal locations.

Workarounds

N/A

Patches

To aid users who aren’t able to upgrade immediately we have provided patches for
the supported release series in accordance with our
maintenance policy
regarding security issues. They are in git-am format and consist of a
single changeset.

6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series
7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series
7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series

Credits

Thank you shinkbr for reporting this!

Affected configurations

Vulners

Node

actionpack_projectactionpackMatch7.2.0.beta1ruby

actionpack_projectactionpackRange7.1.0–7.1.3.4ruby

actionpack_projectactionpackRange7.0.0–7.0.8.4ruby

actionpack_projectactionpackRange6.1.0–6.1.7.8ruby

VendorProductVersionCPE
actionpack_projectactionpack7.2.0.beta1cpe:2.3:a:actionpack_project:actionpack:7.2.0.beta1:*:*:*:*:ruby:*:*
actionpack_projectactionpack*cpe:2.3:a:actionpack_project:actionpack:*:*:*:*:*:ruby:*:*

Vendor	Product	Version	CPE
actionpack_project	actionpack	7.2.0.beta1	cpe:2.3:a:actionpack_project:actionpack:7.2.0.beta1:::::ruby::
actionpack_project	actionpack	*	cpe:2.3:a:actionpack_project:actionpack::::::ruby::*