CVE-2024-54133: Action Pack CSP XSS Vulnerability

CVE-2024-54133 Overview

CVE-2024-54133 is a Cross-Site Scripting (XSS) vulnerability in the content_security_policy helper within Ruby on Rails Action Pack framework. Action Pack is a core framework component for handling and responding to web requests in Rails applications. This vulnerability allows attackers to inject malicious directives into Content-Security-Policy (CSP) headers when applications dynamically construct CSP headers from untrusted user input, potentially bypassing critical security protections.

Critical Impact

Applications setting Content-Security-Policy headers dynamically from untrusted user input may have their CSP protections bypassed, enabling XSS attacks and other client-side exploits.

Affected Products

• Action Pack versions 5.2.0 through 7.0.8.6
• Action Pack versions 7.1.0 through 7.1.5.0
• Action Pack versions 7.2.0 through 7.2.2.0
• Action Pack versions 8.0.0 (prior to 8.0.0.1)

Discovery Timeline

• 2024-12-10 - CVE-2024-54133 published to NVD
• 2025-03-07 - Last updated in NVD database

Technical Details for CVE-2024-54133

Vulnerability Analysis

This vulnerability exists in the content_security_policy helper function within Action Pack, which is used to dynamically set Content-Security-Policy HTTP headers. When developers construct CSP directives using untrusted user input without proper validation, attackers can craft malicious input that injects additional CSP directives or modifies existing ones.

Content-Security-Policy headers are a critical browser security mechanism designed to prevent XSS attacks by restricting which resources can be loaded and executed. By injecting arbitrary directives into the CSP header, an attacker could potentially add permissive rules like script-src 'unsafe-inline' or script-src attacker.com, effectively disabling the CSP protections that were intended to prevent script injection attacks.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), as the core issue stems from insufficient sanitization of user-controlled input that ends up in security-sensitive HTTP headers.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the content_security_policy helper when processing user-supplied values. The helper function did not properly escape or validate inputs that could contain CSP directive separators (such as semicolons) or other control characters that could be interpreted as new directives by the browser's CSP parser.

When untrusted input is passed directly to the CSP helper without sanitization, attackers can inject delimiter characters that the browser interprets as directive boundaries, allowing them to append their own CSP rules to the policy.

Attack Vector

The attack vector is network-based, requiring user interaction. An attacker must identify an application endpoint where user input influences the construction of CSP headers. The attacker would then craft a malicious payload containing CSP directive separators and injected directives.

For example, if an application dynamically includes a user-provided value in a CSP directive, an attacker could supply input like value; script-src 'unsafe-inline' to inject a permissive script source directive. Once the victim's browser processes the manipulated CSP header, the injected directive could weaken security controls, enabling subsequent XSS attacks.

The vulnerability requires specific application configurations where user input flows into CSP header construction, which limits the attack surface to applications using this particular pattern.

Detection Methods for CVE-2024-54133

Indicators of Compromise

• Unusual or unexpected CSP directive values appearing in HTTP response headers
• CSP headers containing multiple semicolon-separated directives where only one was expected
• Application logs showing user input containing CSP directive keywords like script-src, unsafe-inline, or unsafe-eval

Detection Strategies

• Review application code for usage of the content_security_policy helper with dynamic or user-controlled values
• Implement Web Application Firewall (WAF) rules to detect CSP directive injection patterns in request parameters
• Monitor HTTP response headers for anomalous CSP configurations that differ from expected baseline policies
• Audit Rails controller and view code for patterns where request parameters are passed to CSP helper methods

Monitoring Recommendations

• Enable detailed logging of CSP header values in production environments
• Configure Content-Security-Policy-Report-Only headers with report-uri to capture policy violations
• Set up alerts for CSP violation reports indicating potential exploitation attempts
• Monitor for unusual patterns in user input fields that may indicate injection attempts

How to Mitigate CVE-2024-54133

Immediate Actions Required

• Upgrade Action Pack to patched versions: 7.0.8.7, 7.1.5.1, 7.2.2.1, or 8.0.0.1
• Audit application code for any usage of content_security_policy helper with untrusted input
• Implement input validation for any user-supplied values that influence CSP construction
• Review and test CSP configurations to ensure expected policies are being applied

Patch Information

Security patches have been released by the Rails team to address this vulnerability. The following versions contain the fix:

• Action Pack 7.0.8.7 - View commit
• Action Pack 7.1.5.1 - View commit
• Action Pack 7.2.2.1 - View commit
• Action Pack 8.0.0.1 - View commit

For additional details, refer to the GitHub Security Advisory and NetApp Security Advisory.

Workarounds

• Avoid setting CSP headers dynamically from untrusted user input entirely
• Implement strict allowlisting for any values that must be included in CSP headers
• Sanitize and validate all user input before using it in CSP construction, removing semicolons and other CSP delimiter characters
• Use static CSP configurations where possible instead of dynamic header generation

# Example: Update Rails Action Pack using Bundler
bundle update actionpack

# Verify the installed version contains the fix
bundle show actionpack
# Expected output should show version 7.0.8.7, 7.1.5.1, 7.2.2.1, or 8.0.0.1+