CVE-2024-37031: Active Admin Ruby on Rails XSS Vulnerability

CVE-2024-37031 Overview

CVE-2024-37031 is a stored cross-site scripting (XSS) vulnerability in the Active Admin (aka activeadmin) framework for Ruby on Rails. Versions prior to 3.2.2 allow authenticated users to inject arbitrary script content into dynamically generated form legends. The issue occurs when users create entities with attacker-controlled names that Active Admin later renders unsanitized in form legends when the entity is edited. The flaw is tracked under [CWE-79] and referenced in GitHub Security Advisory GHSA-9mg6-x45v-hcfm. Version 4.0.0.beta7 also contains the fix.

Critical Impact
A user with entity-creation privileges can persist JavaScript that executes in an administrator's browser session when the entity is later edited, enabling session theft and administrative action hijacking.

Affected Products

Active Admin (activeadmin gem) for Ruby on Rails, all versions before 3.2.2
Active Admin 4.0.0.beta releases prior to 4.0.0.beta7
Rails applications that expose Active Admin resource forms with dynamically titled legends

Discovery Timeline

2024-06-03 - CVE-2024-37031 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37031

Vulnerability Analysis

Active Admin generates administrative forms for Rails models and derives legend text from record attributes such as the entity name. In versions before 3.2.2, the framework interpolated these attribute values into form legends without HTML-escaping them. An attacker who can create or update a record with a crafted name field persists that payload in the database. When any Active Admin user subsequently opens the edit form for that record, the browser parses the injected markup as HTML and executes attached script content in the context of the Active Admin origin.

The impact scales with the privileges of the victim. Active Admin is commonly used as a superuser back office, so triggering the payload in an administrator session grants an attacker access to sensitive data, CSRF tokens, and any action the administrator can perform.

Root Cause

The root cause is missing output encoding in the dynamic form legend rendering path. Rails' default view helpers escape strings marked as unsafe, but Active Admin's legend construction treated the derived title as HTML-safe. Any HTML metacharacters supplied via record attributes flowed directly into the DOM. The fix in 3.2.2 and 4.0.0.beta7 enforces escaping on legend content sourced from user-controlled attributes.

Attack Vector

Exploitation requires network access to the Active Admin interface and a user account with permission to create or modify resources whose names appear in form legends. The attacker submits a record whose name attribute contains an HTML payload such as an image tag with an onerror handler. Because the injection is persisted, a second victim, typically an administrator with a higher privilege set, triggers execution simply by editing the record. User interaction is required, and the scope changes from the attacker's account to the victim's browser context.

No public exploit code or proof-of-concept has been published for this issue as of the last NVD update.

Detection Methods for CVE-2024-37031

Indicators of Compromise

Database records in Active Admin-managed tables whose display name attributes contain HTML tags, <script> fragments, on*= event handlers, or javascript: URIs
Rails application logs showing PATCH or POST requests to Active Admin resource endpoints with request bodies containing HTML metacharacters in name-like fields
Outbound requests from administrator browser sessions to unfamiliar hosts shortly after loading an Active Admin edit page

Detection Strategies

Query Active Admin-managed tables for stored values matching regex patterns such as <[a-z]+[^>]*> in string columns rendered as form titles
Enable Content Security Policy (CSP) reporting on the Active Admin host and alert on script-src or inline-script violations originating from /admin paths
Review the installed gem version with bundle list activeadmin and flag any host running a version below 3.2.2 or 4.0.0.beta7

Monitoring Recommendations

Instrument Rails controllers to log the authenticated user, target resource, and payload size for every write to Active Admin resources
Forward web server and Rails logs to a centralized analytics platform and build detections for HTML tag characters in fields that should be plain text
Monitor administrator sessions for anomalous API calls issued from the browser immediately after navigating to a resource edit page

How to Mitigate CVE-2024-37031

Immediate Actions Required

Upgrade the activeadmin gem to 3.2.2 or later, or to 4.0.0.beta7 if tracking the 4.x pre-release line
Audit existing records in Active Admin-managed tables for previously injected HTML in name fields and sanitize or remove offending values
Rotate administrator session cookies and API tokens if unpatched Active Admin instances have been exposed to untrusted users

Patch Information

The maintainers released the fix in Active Admin v3.2.2, published to RubyGems. Version 4.0.0.beta7 contains the same correction for teams tracking the 4.x branch. Update the Gemfile constraint, run bundle update activeadmin, and redeploy the Rails application. Full remediation guidance is documented in GitHub Security Advisory GHSA-9mg6-x45v-hcfm.

Workarounds

Restrict Active Admin access to trusted internal networks or a VPN until the upgrade is deployed
Override the affected form legend rendering in a local decorator to call ERB::Util.html_escape on any attribute value used as legend text
Deploy a strict Content Security Policy that disallows inline script execution on Active Admin routes to blunt payload execution

bash

# Configuration example: pin the patched gem and reinstall
bundle update activeadmin --conservative
bundle list | grep activeadmin   # verify >= 3.2.2