Vulnerability advisory

GHSA-pj73-v5mw-pm9j

Possible XSS Security Vulnerability in SafeBuffer#bytesplice

Published Mar 15, 2023Updated Jan 10, 2025OSV record ↗

Also known as CVE-2023-28120

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected versions

activesupport RubyGems

All activesupport advisories →

Affected	Fixed in
`7.0.0` to before 7.0.4.3	`7.0.4.3`Advisories →
Also listed as affected (12) `7.0.0` `7.0.1` `7.0.2` `7.0.2.1` `7.0.2.2` `7.0.2.3` `7.0.2.4` `7.0.3` `7.0.3.1` `7.0.4` `7.0.4.1` `7.0.4.2`
All versions before 6.1.7.3	`6.1.7.3`Advisories →
Also listed as affected (410) `1.0.0` `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1.0` `1.1.1` `1.2.1` `1.2.2` `1.2.3` `1.2.4` `1.2.5` `1.3.0` `1.3.1` `1.4.0` `1.4.1` `1.4.2` `1.4.3` `1.4.4` `2.0.0` `2.0.1` `2.0.2` `2.0.4` `2.0.5` `2.1.0` `2.1.1` `2.1.2` `2.2.2` `2.2.3` `2.3.10` `2.3.11` `2.3.12` `2.3.14` `2.3.15` `2.3.16` `2.3.17` `2.3.18` `2.3.2` `2.3.3` `2.3.4` `2.3.5` `2.3.6` `2.3.6.pre` `2.3.7` `2.3.8` `2.3.8.pre1` `2.3.9` `2.3.9.pre` `3.0.0` `3.0.0.beta` `3.0.0.beta2` `3.0.0.beta3` `3.0.0.beta4` `3.0.0.rc` `3.0.0.rc2` `3.0.1` `3.0.10` `3.0.10.rc1` `3.0.11` `3.0.12` `3.0.12.rc1` `3.0.13` `3.0.13.rc1` `3.0.14` `3.0.15` `3.0.16` `3.0.17` `3.0.18` `3.0.19` `3.0.2` `3.0.20` `3.0.3` `3.0.4` `3.0.4.rc1` `3.0.5` `3.0.5.rc1` `3.0.6` `3.0.6.rc1` `3.0.6.rc2` `3.0.7` `3.0.7.rc1` `3.0.7.rc2` `3.0.8` `3.0.8.rc1` `3.0.8.rc2` `3.0.8.rc4` `3.0.9` `3.0.9.rc1` `3.0.9.rc3` `3.0.9.rc4` `3.0.9.rc5` `3.0.pre` `3.1.0` `3.1.0.beta1` `3.1.0.rc1` `3.1.0.rc2` `3.1.0.rc3` `3.1.0.rc4` `3.1.0.rc5` `3.1.0.rc6` `3.1.0.rc8` `3.1.1` `3.1.1.rc1` `3.1.1.rc2` `3.1.1.rc3` `3.1.10` `3.1.11` `3.1.12` `3.1.2` `3.1.2.rc1` `3.1.2.rc2` `3.1.3` `3.1.4` `3.1.4.rc1` `3.1.5` `3.1.5.rc1` `3.1.6` `3.1.7` `3.1.8` `3.1.9` `3.2.0` `3.2.0.rc1` `3.2.0.rc2` `3.2.1` `3.2.10` `3.2.11` `3.2.12` `3.2.13` `3.2.13.rc1` `3.2.13.rc2` `3.2.14` `3.2.14.rc1` `3.2.14.rc2` `3.2.15` `3.2.15.rc1` `3.2.15.rc2` `3.2.15.rc3` `3.2.16` `3.2.17` `3.2.18` `3.2.19` `3.2.2` `3.2.2.rc1` `3.2.20` `3.2.21` `3.2.22` `3.2.22.1` `3.2.22.2` `3.2.22.3` `3.2.22.4` `3.2.22.5` `3.2.3` `3.2.3.rc1` `3.2.3.rc2` `3.2.4` `3.2.4.rc1` `3.2.5` `3.2.6` `3.2.7` `3.2.7.rc1` `3.2.8` `3.2.8.rc1` `3.2.8.rc2` `3.2.9` `3.2.9.rc1` `3.2.9.rc2` `3.2.9.rc3` `4.0.0` `4.0.0.beta1` `4.0.0.rc1` `4.0.0.rc2` `4.0.1` `4.0.1.rc1` `4.0.1.rc2` `4.0.1.rc3` `4.0.1.rc4` `4.0.10` `4.0.10.rc1` `4.0.10.rc2` `4.0.11` `4.0.11.1` `4.0.12` `4.0.13` `4.0.13.rc1` `4.0.2` `4.0.3` `4.0.4` `4.0.4.rc1` `4.0.5` `4.0.6` `4.0.6.rc1` `4.0.6.rc2` `4.0.6.rc3` `4.0.7` `4.0.8` `4.0.9` `4.1.0` `4.1.0.beta1` `4.1.0.beta2` `4.1.0.rc1` `4.1.0.rc2` `4.1.1` `4.1.10` `4.1.10.rc1` `4.1.10.rc2` `4.1.10.rc3` `4.1.10.rc4` `4.1.11` `4.1.12` `4.1.12.rc1` `4.1.13` `4.1.13.rc1` `4.1.14` `4.1.14.1` `4.1.14.2` `4.1.14.rc1` `4.1.14.rc2` `4.1.15` `4.1.15.rc1` `4.1.16` `4.1.16.rc1` `4.1.2` `4.1.2.rc1` `4.1.2.rc2` `4.1.2.rc3` `4.1.3` `4.1.4` `4.1.5` `4.1.6` `4.1.6.rc1` `4.1.6.rc2` `4.1.7` `4.1.7.1` `4.1.8` `4.1.9` `4.1.9.rc1` `4.2.0` `4.2.0.beta1` `4.2.0.beta2` `4.2.0.beta3` `4.2.0.beta4` `4.2.0.rc1` `4.2.0.rc2` `4.2.0.rc3` `4.2.1` `4.2.1.rc1` `4.2.1.rc2` `4.2.1.rc3` `4.2.1.rc4` `4.2.10` `4.2.10.rc1` `4.2.11` `4.2.11.1` `4.2.11.2` `4.2.11.3` `4.2.2` `4.2.3` `4.2.3.rc1` `4.2.4` `4.2.4.rc1` `4.2.5` `4.2.5.1` `4.2.5.2` `4.2.5.rc1` `4.2.5.rc2` `4.2.6` `4.2.6.rc1` `4.2.7` `4.2.7.1` `4.2.7.rc1` `4.2.8` `4.2.8.rc1` `4.2.9` `4.2.9.rc1` `4.2.9.rc2` `5.0.0` `5.0.0.1` `5.0.0.beta1` `5.0.0.beta1.1` `5.0.0.beta2` `5.0.0.beta3` `5.0.0.beta4` `5.0.0.racecar1` `5.0.0.rc1` `5.0.0.rc2` `5.0.1` `5.0.1.rc1` `5.0.1.rc2` `5.0.2` `5.0.2.rc1` `5.0.3` `5.0.4` `5.0.4.rc1` `5.0.5` `5.0.5.rc1` `5.0.5.rc2` `5.0.6` `5.0.6.rc1` `5.0.7` `5.0.7.1` `5.0.7.2` `5.1.0` `5.1.0.beta1` `5.1.0.rc1` `5.1.0.rc2` `5.1.1` `5.1.2` `5.1.2.rc1` `5.1.3` `5.1.3.rc1` `5.1.3.rc2` `5.1.3.rc3` `5.1.4` `5.1.4.rc1` `5.1.5` `5.1.5.rc1` `5.1.6` `5.1.6.1` `5.1.6.2` `5.1.7` `5.1.7.rc1` `5.2.0` `5.2.0.beta1` `5.2.0.beta2` `5.2.0.rc1` `5.2.0.rc2` `5.2.1` `5.2.1.1` `5.2.1.rc1` `5.2.2` `5.2.2.1` `5.2.2.rc1` `5.2.3` `5.2.3.rc1` `5.2.4` `5.2.4.1` `5.2.4.2` `5.2.4.3` `5.2.4.4` `5.2.4.5` `5.2.4.6` `5.2.4.rc1` `5.2.5` `5.2.6` `5.2.6.1` `5.2.6.2` `5.2.6.3` `5.2.7` `5.2.7.1` `5.2.8` `5.2.8.1` `6.0.0` `6.0.0.beta1` `6.0.0.beta2` `6.0.0.beta3` `6.0.0.rc1` `6.0.0.rc2` `6.0.1` `6.0.1.rc1` `6.0.2` `6.0.2.1` `6.0.2.2` `6.0.2.rc1` `6.0.2.rc2` `6.0.3` `6.0.3.1` `6.0.3.2` `6.0.3.3` `6.0.3.4` `6.0.3.5` `6.0.3.6` `6.0.3.7` `6.0.3.rc1` `6.0.4` `6.0.4.1` `6.0.4.2` `6.0.4.3` `6.0.4.4` `6.0.4.5` `6.0.4.6` `6.0.4.7` `6.0.4.8` `6.0.5` `6.0.5.1` `6.0.6` `6.0.6.1` `6.1.0` `6.1.0.rc1` `6.1.0.rc2` `6.1.1` `6.1.2` `6.1.2.1` `6.1.3` `6.1.3.1` `6.1.3.2` `6.1.4` `6.1.4.1` `6.1.4.2` `6.1.4.3` `6.1.4.4` `6.1.4.5` `6.1.4.6` `6.1.4.7` `6.1.5` `6.1.5.1` `6.1.6` `6.1.6.1` `6.1.7` `6.1.7.1` `6.1.7.2`

Description

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized. When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation. Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.