CVE-2022-24722 Cross-site Scripting in view_component
Attackers can execute arbitrary scripts in victim browsers via unsanitized user input in view_component translations, affecting Ruby on Rails developers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-24722?
CVE-2022-24722 is a high-severity cross-site scripting vulnerability in github view_component, published on 2 Mar 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.
Weakness: CWE-79
Which versions are affected by CVE-2022-24722?
4 open source packages ship an affected version, including view_component. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
view_component RubyGems | From 2.31.0 | 2.31.2 |
view_component RubyGems | From 2.31.0 | 2.31.2 |
view_component RubyGems | From 2.32.0 | 2.49.1 |
view_component RubyGems | From 2.32.0 | 2.49.1 |
Products include Github Viewcomponent.
How do I fix CVE-2022-24722?
Upgrade view_component to a fixed version for your release line: 2.31.2 or 2.49.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-24722 being exploited?
There is no known exploitation of CVE-2022-24722 in the wild and no public exploit code.
Sources
Also known as GHSA-cm9w-c4rj-r2cf.