Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.

Rails core team reports :

All users of Rails 1.2.4 or earlier are advised to upgrade to 1.2.5, though it isn't strictly necessary if you aren't working with JSON.
For more information the JSON vulnerability, see CVE-2007-3227.

A cross site scripting (XSS) bug allowed attackers to execute JavaScript code in the context of other websites (CVE-2007-3227).

The remote host is affected by the vulnerability described in GLSA-200711-17 (Ruby on Rails: Multiple vulnerabilities)

    candlerb found that ActiveResource, when processing responses using the     Hash.from_xml() function, does not properly sanitize filenames     (CVE-2007-5380). The session management functionality allowed the     'session_id' to be set in the URL (CVE-2007-5380). BCC discovered that     the to_json() function does not properly sanitize input before     returning it to the user (CVE-2007-3227).
  Impact :

    Unauthenticated remote attackers could exploit these vulnerabilities to     determine the existence of files or to read the contents of arbitrary     XML files; conduct session fixation attacks and gain unauthorized     access; and to execute arbitrary HTML and script code in a user's     browser session in context of an affected site by enticing a user to     browse a specially crafted URL.
  Workaround :

    There is no known workaround at this time.

A cross site scripting (XSS) bug allowed attackers to execute JavaScript code in the context of other websites (CVE-2007-3227).

Specially crafted requests could crash an application when processing XML data (CVE-2007-5379).

ID	Name	Product	Family	Severity
28350	FreeBSD : rubygem-rails -- JSON XSS vulnerability (44fb0302-9d38-11dc-9114-001c2514716c)	Nessus	FreeBSD Local Security Checks	medium
28225	openSUSE 10 Security Update : rubygem-activesupport (rubygem-activesupport-4568)	Nessus	SuSE Local Security Checks	medium
28217	GLSA-200711-17 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
28206	openSUSE 10 Security Update : rubygem-activesupport (rubygem-activesupport-4565)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2007-3227

medium

Tenable Plugins

medium

medium

medium

medium