Headline

GHSA-8qgm-g2vv-vwvc: RailsAdmin Cross-site Scripting vulnerability in the list view

Impact

RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. The issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.

Patches

Upgrade to 3.1.3 or 2.3.0.

Workarounds

Copy the index view (located under the path app/views/rails_admin/main/index.html.erb) from the RailsAdmin version you use, and place it into your application by using the same path.
Open the view file by an editor, and remove strip_tags from the title attribute:

               <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>
                 <% value = property.pretty_value %>
-                <td class="<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>" title="<%= strip_tags(value.to_s) %>">
+                <td class="<%= [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>" title="<%= value %>">
                   <%= value %>
                 </td>
               <% end %>

Note: The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can’t upgrade RailsAdmin now for a reason.

References

https://owasp.org/www-community/attacks/xss/ https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags

4 months ago

ghsa

Open in Source

#xss #vulnerability #git #perl #ruby

Impact

RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute.
The issue was originally reported in railsadminteam/rails_admin#3686.

Patches

Upgrade to 3.1.3 or 2.3.0.

Workarounds

Copy the index view (located under the path app/views/rails_admin/main/index.html.erb) from the RailsAdmin version you use, and place it into your application by using the same path.

Open the view file by an editor, and remove strip_tags from the title attribute:

       <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>
         <% value = property.pretty\_value %>

- <td class="<%= [property.sticky? && 'sticky’, property.css_class, property.type_css_class].select(&:present?).join(' ') %>" title="<%= strip_tags(value.to_s) %>">

           <td class="<%= \[property.sticky? && 'sticky', property.css\_class, property.type\_css\_class\].select(&:present?).join(' ') %>" title="<%= value %>">
             <%= value %>
           </td>
         <% end %>

References

https://owasp.org/www-community/attacks/xss/
https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags

References