CVE-2020-5267 PoC — ActionView 跨站脚本漏洞

Source

https://github.com/GUI/legacy-rails-CVE-2020-5267-patch

Associated Vulnerability

Title:ActionView 跨站脚本漏洞 (CVE-2020-5267)
Description:ActionView是一套开源的问题需求跟踪工具。该产品支持权限配置、统计报表、文档分享和工作日志等功能。 ActionView 6.0.2.2之前版本和5.2.4.2中的JavaScript文字转义助手存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。

Description

Patch CVE-2020-5267 for Rails 4 and Rails 3

Readme

# legacy-rails-CVE-2020-5267-patch

[![CI](https://github.com/GUI/legacy-rails-CVE-2020-5267-patch/workflows/CI/badge.svg)](https://github.com/GUI/legacy-rails-CVE-2020-5267-patch/actions?workflow=CI)

A patch for [CVE-2020-5267](https://github.com/advisories/GHSA-65cv-r6x7-79hv) for Rails 4 and Rails 3. Upgrading Rails would definitely be better, but in the meantime if you're stuck on older versions of Rails, this provides the monkey patch noted in the security advisory packaged and tested as a gem.

## Installation

Add this line to your application's Gemfile:

```ruby
gem 'legacy-rails-CVE-2020-5267-patch'
```

And then execute:

```
$ bundle install
```

File Snapshot


 [4.0K]  /data/pocs/46e24f325c1381e6bc7b61de85b4e7670fca8b98
├── [ 111]  Appraisals
├── [4.0K]  bin
│   ├── [ 367]  console
│   └── [ 131]  setup
├── [  98]  CHANGELOG.md
├── [ 165]  Gemfile
├── [2.8K]  Gemfile.lock
├── [4.0K]  gemfiles
│   ├── [ 164]  rails_3.2.gemfile
│   ├── [2.3K]  rails_3.2.gemfile.lock
│   ├── [ 164]  rails_4.2.gemfile
│   └── [2.8K]  rails_4.2.gemfile.lock
├── [1.5K]  legacy-rails-CVE-2020-5267-patch.gemspec
├── [4.0K]  lib
│   ├── [4.0K]  legacy-rails-CVE-2020-5267-patch
│   │   └── [  59]  version.rb
│   └── [ 611]  legacy-rails-CVE-2020-5267-patch.rb
├── [1.1K]  LICENSE.txt
├── [ 198]  Rakefile
├── [ 666]  README.md
└── [4.0K]  test
    ├── [1.9K]  patch_test.rb
    └── [ 126]  test_helper.rb

5 directories, 18 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!