CVE-2024-29034

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.
Configurations

No configuration.

History

21 Nov 2024, 09:07

Type Values Removed Values Added
References () https://github.com/carrierwaveuploader/carrierwave/commit/25b1c800d45ef8e78dc445ebe3bd8a6e3f0a3477 - () https://github.com/carrierwaveuploader/carrierwave/commit/25b1c800d45ef8e78dc445ebe3bd8a6e3f0a3477 -
References () https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-vfmv-jfc5-pjjw - () https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-vfmv-jfc5-pjjw -
Summary
  • (es) CarrierWave es una solución para carga de archivos para Rails, Sinatra y otros frameworks web Ruby. La vulnerabilidad CVE-2023-49090 no se solucionó por completo. Esta vulnerabilidad se debe al hecho de que al cargar objetos en el almacenamiento, incluido Amazon S3, es posible establecer un valor de tipo de contenido que los navegadores interpretan como diferente de lo permitido por "content_type_allowlist", al proporcionar múltiples valores separados por comas. Este valor omitido se puede utilizar para provocar XSS. Actualice a 3.0.7 o 2.2.6.

24 Mar 2024, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-03-24 20:15

Updated : 2024-11-21 09:07


NVD link : CVE-2024-29034

Mitre link : CVE-2024-29034

CVE.ORG link : CVE-2024-29034


JSON object : View

Products Affected

No product.

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-436

Interpretation Conflict