CVE-2024-37031 activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends
Stored XSS in Active Admin allows attackers to execute arbitrary scripts via entity names, impacting Ruby on Rails applications using this admin framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-37031?
CVE-2024-37031 is a medium-severity cross-site scripting vulnerability in n/a, published on 3 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.
Weakness: CWE-79
Which versions are affected by CVE-2024-37031?
4 open source packages ship an affected version, including activeadmin.
| Package | Affected | Fixed in |
|---|---|---|
activeadmin RubyGems | All versions | 3.2.2 |
activeadmin RubyGems | All versions | 3.2.2 |
activeadmin RubyGems | From 4.0.0.beta1 | 4.0.0.beta7 |
activeadmin RubyGems | From 4.0.0.beta1 | 4.0.0.beta7 |
How do I fix CVE-2024-37031?
Upgrade activeadmin to a fixed version for your release line: 3.2.2 or 4.0.0.beta7.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-37031 being exploited?
There is no known exploitation of CVE-2024-37031 in the wild and no public exploit code.
Sources
Also known as GHSA-9mg6-x45v-hcfm.