Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-28103

CVE-2024-28103: Missing security headers in Action Pack on non-HTML responses

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-28103
GHSA ID
GHSA-fwhr-88qx-h9g7
EPSS Score
0.70394%
CWE
CWE-20
Published
6/4/2024
Updated
12/6/2024
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
actionpackrubygems>= 6.1.0, < 6.1.7.86.1.7.8
actionpackrubygems>= 7.0.0, < 7.0.8.47.0.8.4
actionpackrubygems>= 7.1.0, < 7.1.3.47.1.3.4
actionpackrubygems= 7.2.0.beta17.2.0.beta2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from conditional logic that only applied security headers to HTML responses. The commit shows removal of: 1) The html_response? check in Middleware#call that acted as a guard clause, and 2) The html_response? method itself. These functions together created the vulnerability by restricting header application based on Content-Type. The test case modification from 'non-html requests will not set a policy' to 'will set a policy' confirms this was the vulnerable code path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

# P*rmissions-Poli*y is Only S*rv** on *TML *ont*nt-Typ* T** *ppli**tion *on*i*ur**l* P*rmissions-Poli*y is only s*rv** on r*spons*s wit* *n *TML r*l*t** *ont*nt-Typ*. T*is **s ***n *ssi*n** t** *V* i**nti*i*r *V*-****-*****. V*rsions *****t**:

Reasoning

T** vuln*r**ility st*mm** *rom *on*ition*l lo*i* t**t only *ppli** s**urity *****rs to *TML r*spons*s. T** *ommit s*ows r*mov*l o*: *) T** *tml_r*spons*? ****k in Mi**l*w*r*#**ll t**t **t** *s * *u*r* *l*us*, *n* *) T** *tml_r*spons*? m*t*o* its*l*.