ruby-advisory-db/gems/carrierwave/CVE-2023-49090.yml at 21500e52db5807c6b388d3f1744b98faefa1aab8 · jasnow/ruby-advisory-db · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
---
gem: carrierwave
cve: 2023-49090
ghsa: gxhx-g4fq-49hj
url: https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj
title: CarrierWave Content-Type allowlist bypass vulnerability,
  possibly leading to XSS
date: 2023-11-29
description: |
  ###Impact
  [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb)
  has a Content-Type allowlist bypass vulnerability, possibly leading to XSS.

  The validation in `allowlisted_content_type?` determines Content-Type
  permissions by performing a partial match.
  If the `content_type` argument of `allowlisted_content_type?` is passed
  a value crafted by the attacker, Content-Types not included in the
  `content_type_allowlist` will be allowed.

  In addition, by setting the Content-Type configured by the attacker
  at the time of file delivery, it is possible to cause XSS on the
  user's browser when the uploaded file is opened.

  ### Patches
  Upgrade to [3.0.5](https://rubygems.org/gems/carrierwave/versions/3.0.5)
  or [2.2.5](https://rubygems.org/gems/carrierwave/versions/2.2.5).

  ### Workarounds
  When validating with `allowlisted_content_type?` in
  [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb),
  forward match(`\\A`) the Content-Type set in `content_type_allowlist`,
  preventing unintentional permission of `text/html;image/png` when
  you want to allow only `image/png` in `content_type_allowlist`.

  ### References
  [OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html#content-type-validation)
cvss_v3: 6.8
patched_versions:
  - "~> 2.2.5"
  - ">= 3.0.5"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-49090
    - https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj
    - https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5
    - https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3
    - https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb
    - https://rubygems.org/gems/carrierwave/versions/2.2.5
    - https://rubygems.org/gems/carrierwave/versions/3.0.5
    - https://github.com/advisories/GHSA-gxhx-g4fq-49hj