CVE-2013-1857 actionpack Cross-site Scripting vulnerability
Remote attackers can execute cross-site scripting attacks via crafted URLs with encoded colons in Ruby on Rails applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-1857?
CVE-2013-1857 is a medium-severity cross-site scripting vulnerability in Redhat Enterprise Linux, published on 19 Mar 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
Weakness: CWE-79
Which versions are affected by CVE-2013-1857?
6 open source packages ship an affected version, including actionpack. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
actionpack RubyGems | All versions | 2.3.18 |
actionpack RubyGems | All versions | 2.3.18 |
actionpack RubyGems | From 3.0.0 | 3.1.12 |
actionpack RubyGems | From 3.0.0 | 3.1.12 |
actionpack RubyGems | From 3.2.0 | 3.2.13 |
actionpack RubyGems | From 3.2.0 | 3.2.13 |
Products include Redhat Enterprise Linux, Rubyonrails Rails, Rubyonrails Ruby on Rails.
How do I fix CVE-2013-1857?
Upgrade actionpack to a fixed version for your release line: 2.3.18, 3.1.12 or 3.2.13.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2013-1857 being exploited?
There is no known exploitation of CVE-2013-1857 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection
- CVE-2021-20325 Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit
- CVE-2018-25011 Memory corruption in libwebp
- CVE-2018-25014 Other in libwebp
- CVE-2014-3585 Supply chain in redhat-upgrade-tool
Sources
Also known as DEBIAN-CVE-2013-1857, GHSA-j838-vfpq-fmf2.