CVE-2013-0256 RDoc contains XSS vulnerability

Medium 4.3 Published 1 Mar 2013 Updated 6 Aug 2024

Remote attackers can execute cross-site scripting attacks via crafted URLs in RDoc generated documents, affecting Ruby developers and users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2013-0256?

CVE-2013-0256 is a medium-severity cross-site scripting vulnerability in Canonical Ubuntu Linux, published on 1 Mar 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

Weakness: CWE-79

Which versions are affected by CVE-2013-0256?

2 open source packages ship an affected version, including rdoc. It affects 3 products.

Package	Affected	Fixed in
`rdoc` RubyGems	From `2.3.0`	`3.12.1`
`rdoc` RubyGems	From `2.3.0`	`3.12.1`

Linux distribution packages (16)

`ruby193-rubygem-activesupport` Red Hat:openshift:1::el6	All versions	`1:3.2.8-4.el6`
`ruby193-rubygem-bcrypt-ruby` Red Hat:openshift:1::el6	All versions	`0:3.0.1-7.el6`
`ruby193-rubygem-bcrypt-ruby-debuginfo` Red Hat:openshift:1::el6	All versions	`0:3.0.1-7.el6`
`ruby193-rubygem-bson` Red Hat:openshift:1::el6	All versions	`0:1.5.2-6.el6op`
`ruby193-rubygem-chunky_png` Red Hat:openshift:1::el6	All versions	`0:1.2.6-3.el6op`
`ruby193-rubygem-ci_reporter` Red Hat:openshift:1::el6	All versions	`0:1.7.2-4.el6op`
`ruby193-rubygem-compass` Red Hat:openshift:1::el6	All versions	`0:0.12.2-4.el6op`
`ruby193-rubygem-fastthread` Red Hat:openshift:1::el6	All versions	`0:1.0.7-7.el6op`
`ruby193-rubygem-fastthread-debuginfo` Red Hat:openshift:1::el6	All versions	`0:1.0.7-7.el6op`
`ruby193-rubygem-haml` Red Hat:openshift:1::el6	All versions	`0:3.1.7-3.el6op`
`ruby193-rubygem-http_connection` Red Hat:openshift:1::el6	All versions	`0:1.4.1-7.el6`
`ruby193-rubygem-rack` Red Hat:openshift:1::el6	All versions	`1:1.4.1-5.el6`
`ruby193-rubygem-rack-test` Red Hat:openshift:1::el6	All versions	`0:0.6.1-3.el6`
`ruby193-rubygem-rspec` Red Hat:openshift:1::el6	All versions	`0:2.11.0-2.el6`
`ruby193-rubygem-treetop` Red Hat:openshift:1::el6	All versions	`0:1.4.10-6.el6`
`ruby193-rubygem-xml-simple` Red Hat:openshift:1::el6	All versions	`0:1.0.12-10.el6op`

Products include Canonical Ubuntu Linux, Ruby-Lang Rdoc, Ruby-Lang Ruby.

How do I fix CVE-2013-0256?

Upgrade rdoc to 3.12.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2013-0256 being exploited?

There is no known exploitation of CVE-2013-0256 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as GHSA-v2r9-c84j-v7xm, RHSA-2013:0728.