CVE-2024-32464 ActionText ContentAttachment can Contain Unsanitized HTML
Attackers can inject unsanitized HTML into ActionText attachments, potentially leading to cross-site scripting attacks in Rails applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-32464?
CVE-2024-32464 is a medium-severity cross-site scripting vulnerability in Rubyonrails Rails, published on 4 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
Which versions are affected by CVE-2024-32464?
5 open source packages ship an affected version, including rails and actiontext. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rails Bitnami | From 7.1.0 | 7.1.4 |
actiontext RubyGems | From 7.1.0 | 7.1.3.4 |
actiontext RubyGems | From 7.1.0 | 7.1.3.4 |
actiontext RubyGems | From 7.2.0.beta1 | 7.2.0.beta2 |
actiontext RubyGems | From 7.2.0.beta1 | 7.2.0.beta2 |
Products include Rubyonrails Rails.
How do I fix CVE-2024-32464?
Upgrade rails to 7.1.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-32464 being exploited?
There is no known exploitation of CVE-2024-32464 in the wild and no public exploit code.
Other vulnerabilities in Rubyonrails Rails
- CVE-2013-0277 Active Record contains deserialization of arbitrary YAML
- CVE-2017-17916 SQL injection in n/a
- CVE-2017-17917 SQL injection in n/a
- CVE-2026-33195 Rails Active Storage has possible Path Traversal in DiskService
- CVE-2024-26142 Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
Sources
Also known as BIT-rails-2024-32464, GHSA-prjp-h48f-jgf6, UBUNTU-CVE-2024-32464.