secure_headers Gem up to 3.8.x/5.1.x/6.2.x on Ruby Newline response splitting

Summaryinfo

A vulnerability classified as critical has been found in secure_headers Gem up to 3.8.x/5.1.x/6.2.x on Ruby. This vulnerability affects unknown code. Performing a manipulation as part of Newline results in response splitting. This vulnerability is known as CVE-2020-5216. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in secure_headers Gem up to 3.8.x/5.1.x/6.2.x on Ruby (Ruby Gem). This affects some unknown processing. The manipulation as part of a Newline leads to a response splitting vulnerability. CWE is classifying the issue as CWE-113. The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.

The weakness was published 01/23/2020 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2020-5216 since 01/02/2020. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Required for exploitation is a authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.9.0, 5.2.0 or 6.3.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Ruby Gem

Name

• secure_headers Gem

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 5.0
• 5.1
• 6.0
• 6.1
• 6.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion