deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-529p-jj47-w3m3
Package: decidim-admin (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.28.0.rc1, < 0.28.1
Patched in: 0.28.1

Summary: Decidim cross-site scripting (XSS) in the admin panel

Details:
### Impact

The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server.

The attacker is able to change  e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source.

### Patches

Available in versions 0.27.6 and 0.28.1.

### Workarounds

Review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. 

### References

OWASP ASVS v4.0.3-5.1.3
GitHub Security Advisory: GHSA-529p-jj47-w3m3
Package: decidim-admin (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.27.6
Patched in: 0.27.6

Summary: Decidim cross-site scripting (XSS) in the admin panel

Details:
### Impact

The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server.

The attacker is able to change  e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source.

### Patches

Available in versions 0.27.6 and 0.28.1.

### Workarounds

Review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. 

### References

OWASP ASVS v4.0.3-5.1.3
GitHub Security Advisory: GHSA-7cx8-44pc-xv3q
Package: decidim (RUBYGEMS)
Severity: MODERATE (CVSS 7.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.28.0.rc1, < 0.28.1
Patched in: 0.28.1

Summary: Decidim cross-site scripting (XSS) in the pagination

Details:
### Impact

The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. 

### Patches

Not available

### Workarounds

Not available

### References

OWASP ASVS v4.0.3-5.1.3

### Credits

This issue was discovered in a security audit organized by the [mitgestalten Partizipationsbüro](https://partizipationsbuero.at/) and funded by [netidee](https://www.netidee.at/) against Decidim done during April 2024. The security audit was implemented by  [AIT Austrian Institute of Technology GmbH](https://www.ait.ac.at/),
GitHub Security Advisory: GHSA-7cx8-44pc-xv3q
Package: decidim (RUBYGEMS)
Severity: MODERATE (CVSS 7.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.27.6
Patched in: 0.27.6

Summary: Decidim cross-site scripting (XSS) in the pagination

Details:
### Impact

The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. 

### Patches

Not available

### Workarounds

Not available

### References

OWASP ASVS v4.0.3-5.1.3

### Credits

This issue was discovered in a security audit organized by the [mitgestalten Partizipationsbüro](https://partizipationsbuero.at/) and funded by [netidee](https://www.netidee.at/) against Decidim done during April 2024. The security audit was implemented by  [AIT Austrian Institute of Technology GmbH](https://www.ait.ac.at/),
GitHub Security Advisory: GHSA-qcj6-vxwx-4rqv
Package: decidim (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 0.27.6
Patched in: 0.27.6

Summary: Decidim vulnerable to data disclosure through the embed feature

Details:
### Impact

If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed. 

### Patches

version 0.27.6

https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705

### Workarounds

Disallow access through your web server to the URLs finished with `/embed.html`
GitHub Security Advisory: GHSA-8qgm-g2vv-vwvc
Package: rails_admin (RUBYGEMS)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0.beta, < 3.1.3
Patched in: 3.1.3

Summary: RailsAdmin Cross-site Scripting vulnerability in the list view

Details:
### Impact
RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute.
The issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.

### Patches
Upgrade to [3.1.4](https://rubygems.org/gems/rails_admin/versions/3.1.4). The vulnerability itself was patched in 3.1.3 but it has a functionality issue.
Initially the vulnerability was thought to exist in versions before 3.0, but it didn't. 2.x users can stay on 2.2.1.

### Workarounds
1. Copy the index view (located under the path `app/views/rails_admin/main/index.html.erb`) from the RailsAdmin version you use, and place it into your application by using the same path.
2. Open the view file by an editor, and change the way to populate the td tag:

```diff
               <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>
                 <% value = property.pretty_value %>
-                <td class="<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>" title="<%= value %>">
+                <%= content_tag(:td, class: [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?), title: strip_tags(value.to_s)) do %>
                   <%= value %>
-                </td>
+                <% end %>
               <% end %>
```

**Note:** The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can't upgrade RailsAdmin now for a reason.

### References
https://owasp.org/www-community/attacks/xss/
https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags
GitHub Security Advisory: GHSA-cj83-2ww7-mvq7
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 3.1.0, < 3.1.5
Patched in: 3.1.5

Summary: Rack ReDoS Vulnerability in HTTP Accept Headers Parsing

Details:
### Summary

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS).

### Details

The fix for https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5.
GitHub Security Advisory: GHSA-5cr9-5jx3-2g39
Package: avo (RUBYGEMS)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0.pre1, <= 3.0.0.pre12
Patched in: unpatched

Summary: avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

Details:
### Summary
Some avo fields are vulnerable to XSS when rendering html based content.

### Details
During the analysis of the web application, a rendered field was discovered that did not filter JS / HTML tags in a safe way and can be abused to execute js code on a client side. The trix field uses the trix editor in the backend to edit rich text data which basically operates with html tags. To display the stored data in a rendered view, the HasHTMLAttributes concern is used. This can be exploited by an attacker to store javascript code in any trix field by intercepting the request and modifying the post data, as the trix editor does not allow adding custom html or js tags on the frontend.

### PoC
![image](https://user-images.githubusercontent.com/26464774/243[PII_REDACTED]7054-9b20-437f-842f-0750d53c9b0e.png)
_Adding javascript in the post request which is used when editing a "post" resource (body is declared as a trix field)_

![image](https://user-images.githubusercontent.com/26464774/243[PII_REDACTED]93a0-5179-4368-977c-ec36d2373925.png)
_Successful execution of JS code on live demo environment_

### Impact
Unlike non-persistent XSS, persistent XSS does not require a social engineering phase. Victims of this attack do not need to be tricked into clicking a link or something like that. However, by exploiting such a vulnerability on this particular target, attackers may be able to gain access to accounts that require special protection, such as administrators of the web service, which is what Avo is primarily intended to be used for.

### Recommendation
The content of a field that contains html code should be sanitized using the according rails helper which uses a whitelist of known-safe tags and attributes. Also this security consideration should be applied to the “as_html” attribute as well because it may contain user controlled input as well.

https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html
GitHub Security Advisory: GHSA-5cr9-5jx3-2g39
Package: avo (RUBYGEMS)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.33.2
Patched in: 2.33.3

Summary: avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

Details:
### Summary
Some avo fields are vulnerable to XSS when rendering html based content.

### Details
During the analysis of the web application, a rendered field was discovered that did not filter JS / HTML tags in a safe way and can be abused to execute js code on a client side. The trix field uses the trix editor in the backend to edit rich text data which basically operates with html tags. To display the stored data in a rendered view, the HasHTMLAttributes concern is used. This can be exploited by an attacker to store javascript code in any trix field by intercepting the request and modifying the post data, as the trix editor does not allow adding custom html or js tags on the frontend.

### PoC
![image](https://user-images.githubusercontent.com/26464774/243[PII_REDACTED]7054-9b20-437f-842f-0750d53c9b0e.png)
_Adding javascript in the post request which is used when editing a "post" resource (body is declared as a trix field)_

![image](https://user-images.githubusercontent.com/26464774/243[PII_REDACTED]93a0-5179-4368-977c-ec36d2373925.png)
_Successful execution of JS code on live demo environment_

### Impact
Unlike non-persistent XSS, persistent XSS does not require a social engineering phase. Victims of this attack do not need to be tricked into clicking a link or something like that. However, by exploiting such a vulnerability on this particular target, attackers may be able to gain access to accounts that require special protection, such as administrators of the web service, which is what Avo is primarily intended to be used for.

### Recommendation
The content of a field that contains html code should be sanitized using the according rails helper which uses a whitelist of known-safe tags and attributes. Also this security consideration should be applied to the “as_html” attribute as well because it may contain user controlled input as well.

https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html
GitHub Security Advisory: GHSA-fwhr-88qx-h9g7
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 7.2.0.beta1
Patched in: 7.2.0.beta2

Summary: Missing security headers in Action Pack on non-HTML responses

Details:
# Permissions-Policy is Only Served on HTML Content-Type

The application configurable Permissions-Policy is only served on responses
with an HTML related Content-Type.

This has been assigned the CVE identifier CVE-2024-28103.


Versions Affected:  >= 6.1.0
Not affected:       < 6.1.0
Fixed Versions:     6.1.7.8, 7.0.8.4, and 7.1.3.4

Impact
------
Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.


Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
N/A

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the supported release series in accordance with our 
[maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues)
regarding security issues. They are in git-am format and consist of a
single changeset.

* 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series
* 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series
* 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series



Credits
-------

Thank you [shinkbr](https://hackerone.com/shinkbr) for reporting this!
GitHub Security Advisory: GHSA-fwhr-88qx-h9g7
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 7.1.0, < 7.1.3.4
Patched in: 7.1.3.4

Summary: Missing security headers in Action Pack on non-HTML responses

Details:
# Permissions-Policy is Only Served on HTML Content-Type

The application configurable Permissions-Policy is only served on responses
with an HTML related Content-Type.

This has been assigned the CVE identifier CVE-2024-28103.


Versions Affected:  >= 6.1.0
Not affected:       < 6.1.0
Fixed Versions:     6.1.7.8, 7.0.8.4, and 7.1.3.4

Impact
------
Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.


Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
N/A

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the supported release series in accordance with our 
[maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues)
regarding security issues. They are in git-am format and consist of a
single changeset.

* 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series
* 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series
* 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series



Credits
-------

Thank you [shinkbr](https://hackerone.com/shinkbr) for reporting this!
GitHub Security Advisory: GHSA-fwhr-88qx-h9g7
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 7.0.0, < 7.0.8.4
Patched in: 7.0.8.4

Summary: Missing security headers in Action Pack on non-HTML responses

Details:
# Permissions-Policy is Only Served on HTML Content-Type

The application configurable Permissions-Policy is only served on responses
with an HTML related Content-Type.

This has been assigned the CVE identifier CVE-2024-28103.


Versions Affected:  >= 6.1.0
Not affected:       < 6.1.0
Fixed Versions:     6.1.7.8, 7.0.8.4, and 7.1.3.4

Impact
------
Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.


Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
N/A

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the supported release series in accordance with our 
[maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues)
regarding security issues. They are in git-am format and consist of a
single changeset.

* 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series
* 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series
* 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series



Credits
-------

Thank you [shinkbr](https://hackerone.com/shinkbr) for reporting this!
GitHub Security Advisory: GHSA-fwhr-88qx-h9g7
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 6.1.0, < 6.1.7.8
Patched in: 6.1.7.8

Summary: Missing security headers in Action Pack on non-HTML responses

Details:
# Permissions-Policy is Only Served on HTML Content-Type

The application configurable Permissions-Policy is only served on responses
with an HTML related Content-Type.

This has been assigned the CVE identifier CVE-2024-28103.


Versions Affected:  >= 6.1.0
Not affected:       < 6.1.0
Fixed Versions:     6.1.7.8, 7.0.8.4, and 7.1.3.4

Impact
------
Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.


Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
N/A

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the supported release series in accordance with our 
[maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues)
regarding security issues. They are in git-am format and consist of a
single changeset.

* 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series
* 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series
* 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series



Credits
-------

Thank you [shinkbr](https://hackerone.com/shinkbr) for reporting this!
GitHub Security Advisory: GHSA-prjp-h48f-jgf6
Package: actiontext (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 7.2.0.beta1
Patched in: 7.2.0.beta2

Summary: ActionText ContentAttachment can Contain Unsanitized HTML

Details:
Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML.

This has been assigned the CVE identifier CVE-2024-32464.


Versions Affected:  >= 7.1.0
Not affected:       < 7.1.0
Fixed Versions:     7.1.3.4

Impact
------
This could lead to a potential cross site scripting issue within the Trix editor.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
N/A

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our [maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues) regarding security issues. They are in git-am format and consist of a single changeset.

* action_text_content_attachment_xss_7_1_stable.patch - Patch for 7.1 series



Credits
-------

Thank you [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting this!
GitHub Security Advisory: GHSA-prjp-h48f-jgf6
Package: actiontext (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1.0, < 7.1.3.4
Patched in: 7.1.3.4

Summary: ActionText ContentAttachment can Contain Unsanitized HTML

Details:
Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML.

This has been assigned the CVE identifier CVE-2024-32464.


Versions Affected:  >= 7.1.0
Not affected:       < 7.1.0
Fixed Versions:     7.1.3.4

Impact
------
This could lead to a potential cross site scripting issue within the Trix editor.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
N/A

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our [maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues) regarding security issues. They are in git-am format and consist of a single changeset.

* action_text_content_attachment_xss_7_1_stable.patch - Patch for 7.1 series



Credits
-------

Thank you [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting this!
GitHub Security Advisory: GHSA-qjqp-xr96-cj99
Package: actiontext (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1.0.beta1, < 7.1.3.3
Patched in: 7.1.3.3

Summary: Trix Editor Arbitrary Code Execution Vulnerability

Details:
The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application.

**Vulnerable Versions**: 

- 1.x series up to and including 1.3.1
- 2.x series up to and including 2.1.0

**Fixed Versions**: 

- v1.3.2
- v2.1.1

**Vector**:

- **Bug 1**: When copying content manipulated by a script, such as:

```js
document.addEventListener('copy', function(e){
  e.clipboardData.setData('text/html', '<div><noscript><div class="123</noscript>456<img src=1 onerror=alert(1)//"></div></noscript></div>');
  e.preventDefault();
});
```

and pasting into the Trix editor, the script within the content is executed.

- **Bug 2**: Similar execution occurs with content structured as:

```js
document.write(`copy<div data-trix-attachment="{&quot;contentType&quot;:&quot;text/html&quot;,&quot;content&quot;:&quot;&lt;img src=1 onerror=alert(101)&gt;HELLO123&quot;}"></div>me`);
```

### Impact:
An attacker could exploit these vulnerabilities to execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.

### Remediation:

**Update Recommendation**: Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.

**CSP Enhancement**: Additionally, enhancing the Content Security Policy (CSP) to disallow inline scripts can significantly mitigate the risk of such vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.

### References:
  - https://github.com/basecamp/trix/releases/tag/v2.1.1
  - https://github.com/basecamp/trix/pull/1147
  - https://github.com/basecamp/trix/pull/1149
  - https://github.com/basecamp/trix/pull/1153

**Credit**: These issues were reported by security researchers [loknop](https://hackerone.com/loknop) and [pinpie](https://hackerone.com/pinpie).