Cross-Site Scripting (XSS) Vulnerability in Phlex Affects User-Provided Data

CVE-2024-28199

What is CVE-2024-28199?

The Phlex framework, designed for creating object-oriented views in Ruby, is exposed to a potential cross-site scripting vulnerability due to improper case-sensitivity handling in its code. This flaw allows attackers to craft malicious user data that could execute JavaScript when a user clicks on an <a> tag containing a user-provided link. Additionally, if user-provided attributes are splatted when rendering HTML tags, it could lead to the inclusion of dangerous event attributes, resulting in unsanctioned JavaScript execution when triggered by another user. To mitigate this risk, users are strongly encouraged to apply the available patches from RubyGems for all 1.x minor versions. As an alternative to immediate upgrades, configuring a robust content security policy that disallows 'unsafe-inline' attributes is recommended.

References