CVE-2018-16471 Rack vulnerable to Cross-site Scripting
Attackers can inject malicious scripts via crafted requests affecting the scheme method, impacting applications that bypass standard escaping mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-16471?
CVE-2018-16471 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 13 Nov 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.
Weakness: CWE-79
Which versions are affected by CVE-2018-16471?
4 open source packages ship an affected version, including rack. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
rack RubyGems | All versions | 1.6.11 |
rack RubyGems | All versions | 1.6.11 |
rack RubyGems | From 2.0.0 | 2.0.6 |
rack RubyGems | From 2.0.0 | 2.0.6 |
Linux distribution packages (3)
rubygem-rack SUSE:Enterprise Storage 4 | All versions | 1.6.11-3.3.1 |
rubygem-rack SUSE:OpenStack Cloud 7 | All versions | 1.6.11-3.3.1 |
rubygem-rack SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.6.11-3.3.1 |
Products include Debian Debian Linux, Rack Project Rack.
How do I fix CVE-2018-16471?
Upgrade rack to a fixed version for your release line: 1.6.11 or 2.0.6.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-16471 being exploited?
There is no known exploitation of CVE-2018-16471 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-16471, DLA-1585-1, GHSA-5r2p-j47h-mhpg, MGASA-2018-0449, SUSE-SU-2019:1440-1, UBUNTU-CVE-2018-16471 and 1 more.