gsd - gsd-2020-5217

gsd-2020-5217

Vulnerability from gsd

Modified

2020-01-23 00:00

Details

If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. > Duplicate script-src directives detected. All but the first instance will be ignored. See https://www.w3.org/TR/CSP3/#parse-serialized-policy > Note: In this case, the user agent SHOULD notify developers that a duplicate directive was > ignored. A console warning might be appropriate, for example. # Workarounds If you are passing user input into the above methods, you could filter out the input: ``` override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")]) ```

Aliases

CVE-2020-5217

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-5217",
    "description": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.",
    "id": "GSD-2020-5217",
    "references": [
      "https://access.redhat.com/errata/RHSA-2020:4366"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "secure_headers",
            "purl": "pkg:gem/secure_headers"
          }
        }
      ],
      "aliases": [
        "CVE-2020-5217",
        "GHSA-xq52-rv6w-397c"
      ],
      "details": "If user-supplied input was passed into append/override_content_security_policy_directives,\na semicolon could be injected leading to directive injection.\n\nThis could be used to e.g. override a script-src directive. Duplicate directives are ignored\nand the first one wins. The directives in secure_headers are sorted alphabetically so they\npretty much all come before script-src. A previously undefined directive would receive a value\neven if SecureHeaders::OPT_OUT was supplied.\n\nThe fixed versions will silently convert the semicolons to spaces and emit a deprecation warning\nwhen this happens. This will result in innocuous browser console messages if being\nexploited/accidentally used. In future releases, we will raise application errors resulting in\n500s.\n\n\u003e Duplicate script-src directives detected. All but the first instance will be ignored.\n\nSee https://www.w3.org/TR/CSP3/#parse-serialized-policy\n\n\u003e Note: In this case, the user agent SHOULD notify developers that a duplicate directive was\n\u003e ignored. A console warning might be appropriate, for example.\n\n# Workarounds\n\nIf you are passing user input into the above methods, you could filter out the input:\n\n```\noverride_content_security_policy_directives(:frame_src, [user_input.gsub(\";\", \" \")])\n```",
      "id": "GSD-2020-5217",
      "modified": "2020-01-23T00:00:00.000Z",
      "published": "2020-01-23T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 4.4,
          "type": "CVSS_V3"
        }
      ],
      "summary": "secure_headers directive injection using semicolon"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2020-5217",
        "STATE": "PUBLIC",
        "TITLE": "Directive injection when using dynamic overrides with user input in RubyGems secure_headers"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "secure_headers",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 3.8.0"
                        },
                        {
                          "version_value": "\u003e= 5.0.0, \u003c 5.1.0"
                        },
                        {
                          "version_value": "\u003e= 6.0.0, \u003c 6.2.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Twitter"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c",
            "refsource": "CONFIRM",
            "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
          },
          {
            "name": "https://github.com/twitter/secure_headers/issues/418",
            "refsource": "MISC",
            "url": "https://github.com/twitter/secure_headers/issues/418"
          },
          {
            "name": "https://github.com/twitter/secure_headers/pull/421",
            "refsource": "MISC",
            "url": "https://github.com/twitter/secure_headers/pull/421"
          },
          {
            "name": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3",
            "refsource": "MISC",
            "url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-xq52-rv6w-397c",
        "discovery": "UNKNOWN"
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2020-5217",
      "cvss_v3": 4.4,
      "date": "2020-01-23",
      "description": "If user-supplied input was passed into append/override_content_security_policy_directives,\na semicolon could be injected leading to directive injection.\n\nThis could be used to e.g. override a script-src directive. Duplicate directives are ignored\nand the first one wins. The directives in secure_headers are sorted alphabetically so they\npretty much all come before script-src. A previously undefined directive would receive a value\neven if SecureHeaders::OPT_OUT was supplied.\n\nThe fixed versions will silently convert the semicolons to spaces and emit a deprecation warning\nwhen this happens. This will result in innocuous browser console messages if being\nexploited/accidentally used. In future releases, we will raise application errors resulting in\n500s.\n\n\u003e Duplicate script-src directives detected. All but the first instance will be ignored.\n\nSee https://www.w3.org/TR/CSP3/#parse-serialized-policy\n\n\u003e Note: In this case, the user agent SHOULD notify developers that a duplicate directive was\n\u003e ignored. A console warning might be appropriate, for example.\n\n# Workarounds\n\nIf you are passing user input into the above methods, you could filter out the input:\n\n```\noverride_content_security_policy_directives(:frame_src, [user_input.gsub(\";\", \" \")])\n```",
      "gem": "secure_headers",
      "ghsa": "xq52-rv6w-397c",
      "patched_versions": [
        "~\u003e 3.8",
        "~\u003e 5.1",
        "\u003e= 6.2.0"
      ],
      "title": "secure_headers directive injection using semicolon",
      "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c3.8.0||\u003e=5.0.0 \u003c5.1.0||\u003e=6.0.0 \u003c6.2.0",
          "affected_versions": "All versions before 3.8.0, all versions starting from 5.0.0 before 5.1.0, all versions starting from 6.0.0 before 6.2.0",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-74",
            "CWE-937"
          ],
          "date": "2020-05-21",
          "description": "The secure_headers gem is vulnerable to a directive injection vulnerability.",
          "fixed_versions": [
            "3.8.0",
            "5.1.0",
            "6.2.0"
          ],
          "identifier": "CVE-2020-5217",
          "identifiers": [
            "CVE-2020-5217",
            "GHSA-xq52-rv6w-397c"
          ],
          "not_impacted": "All versions starting from 3.8.0 before 5.0.0, all versions starting from 5.1.0 before 6.0.0, all versions starting from 6.2.0",
          "package_slug": "gem/secure_headers",
          "pubdate": "2020-01-23",
          "solution": "Upgrade to versions 3.8.0, 5.1.0, 6.2.0 or above.",
          "title": "Injection Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-5217"
          ],
          "uuid": "3a9043b9-524b-47b3-b9a6-28c9d167d72c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.8.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.1.0",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.2.0",
                "versionStartIncluding": "6.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-5217"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-74"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
            },
            {
              "name": "https://github.com/twitter/secure_headers/issues/418",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/twitter/secure_headers/issues/418"
            },
            {
              "name": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c",
              "refsource": "CONFIRM",
              "tags": [
                "Mitigation",
                "Third Party Advisory"
              ],
              "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
            },
            {
              "name": "https://github.com/twitter/secure_headers/pull/421",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/twitter/secure_headers/pull/421"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2020-05-21T13:51Z",
      "publishedDate": "2020-01-23T03:15Z"
    }
  }
}

CVE-2020-5217 (GCVE-0-2020-5217)

Vulnerability from cvelistv5

Published

2020-01-23 02:15

Modified

2024-08-04 08:22

Severity ?

4.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Summary

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

References

URL

Tags

	https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c	x_refsource_CONFIRM
	https://github.com/twitter/secure_headers/issues/418	x_refsource_MISC
	https://github.com/twitter/secure_headers/pull/421	x_refsource_MISC
	https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Twitter	secure_headers	Version: < 3.8.0 Version: >= 5.0.0, < 5.1.0 Version: >= 6.0.0, < 6.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:22:08.919Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/twitter/secure_headers/issues/418"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/twitter/secure_headers/pull/421"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "secure_headers",
          "vendor": "Twitter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.8.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-23T02:15:17",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twitter/secure_headers/issues/418"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twitter/secure_headers/pull/421"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
        }
      ],
      "source": {
        "advisory": "GHSA-xq52-rv6w-397c",
        "discovery": "UNKNOWN"
      },
      "title": "Directive injection when using dynamic overrides with user input in RubyGems secure_headers",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-5217",
          "STATE": "PUBLIC",
          "TITLE": "Directive injection when using dynamic overrides with user input in RubyGems secure_headers"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "secure_headers",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.8.0"
                          },
                          {
                            "version_value": "\u003e= 5.0.0, \u003c 5.1.0"
                          },
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Twitter"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c",
              "refsource": "CONFIRM",
              "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
            },
            {
              "name": "https://github.com/twitter/secure_headers/issues/418",
              "refsource": "MISC",
              "url": "https://github.com/twitter/secure_headers/issues/418"
            },
            {
              "name": "https://github.com/twitter/secure_headers/pull/421",
              "refsource": "MISC",
              "url": "https://github.com/twitter/secure_headers/pull/421"
            },
            {
              "name": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3",
              "refsource": "MISC",
              "url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-xq52-rv6w-397c",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-5217",
    "datePublished": "2020-01-23T02:15:17",
    "dateReserved": "2020-01-02T00:00:00",
    "dateUpdated": "2024-08-04T08:22:08.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-xq52-rv6w-397c

Vulnerability from github

Published

2020-01-23 02:28

Modified

2023-05-16 16:09

Severity ?

4.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

Directive injection when using dynamic overrides with user input

Details

Impact

If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection.

This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied.

The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.

Duplicate script-src directives detected. All but the first instance will be ignored.

See https://www.w3.org/TR/CSP3/#parse-serialized-policy

Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.

Patches

Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

Workarounds

If you are passing user input into the above methods, you could filter out the input:

ruby override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")])

References

Reported in https://github.com/twitter/secure_headers/issues/418 https://www.w3.org/TR/CSP3/#parse-serialized-policy

For more information

If you have any questions or comments about this advisory: * Open an issue in this repo * DM @ndm on twitter

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "secure_headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "secure_headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "secure_headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5217"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-01-23T02:12:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIf user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.\n\nThis could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.\n\nThe fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.\n\n\u003e Duplicate script-src directives detected.  All but the first instance will be ignored.\n\nSee https://www.w3.org/TR/CSP3/#parse-serialized-policy\n\n\u003e Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.\n\n### Patches\n\nDepending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.\n\n### Workarounds\n\nIf you are passing user input into the above methods, you could filter out the input:\n\n```ruby\noverride_content_security_policy_directives(:frame_src, [user_input.gsub(\";\", \" \")])\n```\n\n### References\n\nReported in https://github.com/twitter/secure_headers/issues/418\nhttps://www.w3.org/TR/CSP3/#parse-serialized-policy\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [this repo](https://github.com/twitter/secure_headers/issues/new)\n* DM @ndm on twitter ",
  "id": "GHSA-xq52-rv6w-397c",
  "modified": "2023-05-16T16:09:56Z",
  "published": "2020-01-23T02:28:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5217"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twitter/secure_headers/issues/418"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twitter/secure_headers/pull/421"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/secure_headers/CVE-2020-5217.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/twitter/secure_headers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Directive injection when using dynamic overrides with user input"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

gsd-2020-5217

Vulnerability from gsd

CVE-2020-5217 (GCVE-0-2020-5217)

Vulnerability from cvelistv5

ghsa-xq52-rv6w-397c

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

Tags

Sightings

Nomenclature