CVE-2024-54133

Executive Summary

CVE-2024-54133 is a Cross-Site Scripting (XSS) vulnerability in the content_security_policy helper of Ruby on Rails Action Pack. The flaw allows an attacker to inject arbitrary CSP directives when the CSP header is built dynamically from untrusted user input. Successful exploitation could lead to a bypass of the Content Security Policy, enabling XSS, data exfiltration, or other client-side attacks. The vulnerability affects all versions from 5.2.0 up to, but not including, the patched releases (7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1). No public exploit code or proof-of-concept is currently available, but the risk is elevated due to the widespread use of Rails and the potential for CSP bypass.

Supply Chain & Package Security

This vulnerability resides in the actionpack gem, a core component of the Ruby on Rails web framework. Organizations using Rails should treat this as a supply chain risk, as the vulnerable code is distributed via RubyGems. Applications that dynamically construct CSP headers from user input (e.g., from database fields, API parameters, or configuration files) are at highest risk. The fix is included in the patched gem versions; updating the gem in the application's Gemfile and running bundle update actionpack is the primary remediation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit a crafted page)
• Scope: Changed (impact may extend to other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for CSP bypass and subsequent XSS makes this a serious concern for applications that handle untrusted input in CSP headers.

Deep Dive & Mechanics

The vulnerability lies in the content_security_policy helper method in Action Pack. This helper is used to generate Content-Security-Policy HTTP headers. When an application passes untrusted user input directly into the helper, the input is not properly sanitized or escaped. An attacker can craft input that includes new directives or overrides existing ones, effectively bypassing the intended CSP.

For example, if an application builds a CSP like:

content_security_policy do |p|
  p.script_src :self, params[:user_provided_source]
end

An attacker could supply https://evil.com; script-src 'unsafe-inline' as the user_provided_source parameter. The resulting CSP header would include both the intended directive and the attacker's injected directive, allowing inline script execution.

The root cause is insufficient input validation in the helper's internal string concatenation logic. The patched versions properly escape semicolons and other CSP-relevant characters, preventing directive injection.

Vulnerable vs. Patched Code

Vulnerable Code (Rails < 7.0.8.7, < 7.1.5.1, < 7.2.2.1, < 8.0.0.1):

# In actionpack/lib/action_dispatch/http/content_security_policy.rb
def build_directive(directive, sources)
  sources = Array(sources)
  if sources.present?
    "#{directive} #{sources.join(' ')}"
  end
end

The sources array is joined without escaping, allowing semicolons or other CSP-breaking characters to be injected.

Patched Code (Rails >= 7.0.8.7, >= 7.1.5.1, >= 7.2.2.1, >= 8.0.0.1):

# In actionpack/lib/action_dispatch/http/content_security_policy.rb
def build_directive(directive, sources)
  sources = Array(sources)
  if sources.present?
    escaped_sources = sources.map { |s| s.gsub(/[;,]/, '') }
    "#{directive} #{escaped_sources.join(' ')}"
  end
end

The fix removes semicolons and commas from each source, preventing directive injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Rails application using a vulnerable version (5.2.0 to 7.0.8.6, 7.1.0 to 7.1.5.0, 7.2.0 to 7.2.2.0, or 8.0.0.0).
• The application dynamically sets CSP headers using untrusted user input (e.g., from a URL parameter, form field, or database).

Exploitation Steps:

1. Identify an endpoint where the CSP is built from user input. For example:

   content_security_policy do |p|
     p.script_src :self, params[:allowed_source]
   end
   

2. Craft a malicious payload that injects a new directive. For example:

   https://trusted.com; script-src 'unsafe-inline' 'unsafe-eval'
   

3. Send the request to the vulnerable endpoint. The resulting CSP header will be:

   Content-Security-Policy: script-src 'self' https://trusted.com; script-src 'unsafe-inline' 'unsafe-eval'
   

4. The injected 'unsafe-inline' and 'unsafe-eval' directives allow arbitrary JavaScript execution, bypassing the original CSP.
5. Deliver an XSS payload (e.g., via a stored comment or reflected parameter) to execute JavaScript in the victim's browser.

Proof-of-Concept (No public exploit available):

# Simulated vulnerable controller
class PagesController < ApplicationController
  def show
    content_security_policy do |p|
      p.script_src :self, params[:src]
    end
    render html: "<script>alert('XSS')</script>".html_safe
  end
end

Request: GET /pages/show?src=https://evil.com;%20script-src%20'unsafe-inline'

Blue Team (Defender)

Detection:

• Monitor for unusual CSP headers in HTTP responses, especially those containing multiple script-src directives or 'unsafe-inline'/'unsafe-eval' keywords.
• Look for application logs where the content_security_policy helper is called with user-supplied parameters.

Hunting:

• Search codebase for dynamic CSP construction patterns:

  grep -r "content_security_policy" app/ --include="*.rb"
  

• Review any use of params, request, or user input inside the CSP block.

Mitigation:

• Immediately update to patched versions (7.0.8.7, 7.1.5.1, 7.2.2.1, or 8.0.0.1).
• As a workaround, sanitize all user input before passing it to the CSP helper:

  sanitized_source = params[:allowed_source].gsub(/[;,]/, '')
  content_security_policy do |p|
    p.script_src :self, sanitized_source
  end
  

• Avoid setting CSP headers dynamically from untrusted input altogether.

Indicators of Compromise (IOCs)

• Network:
  • HTTP responses with Content-Security-Policy headers containing multiple script-src directives.
  • CSP headers containing 'unsafe-inline' or 'unsafe-eval' where not expected.
• Application Logs:
  • Unusual parameters passed to endpoints that set CSP headers.
  • Error logs related to CSP parsing (e.g., "Invalid directive" warnings).
• File System:
  • Modified Gemfile.lock showing an older version of actionpack (e.g., actionpack (7.0.8.6)).

Detection Engineering

YARA Rule

rule CVE_2024_54133_Rails_CSP_Injection {
    meta:
        description = "Detects vulnerable Rails CSP helper usage in source code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54133"
    strings:
        $vuln_pattern = /content_security_policy\s+do\s*\|[^|]*\|.*params\[/
        $unsafe_call = /\.script_src\s+.*params\[/
    condition:
        any of them
}

Sigma Rule

title: Suspicious CSP Header with Multiple script-src Directives
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP responses with Content-Security-Policy headers containing multiple script-src directives, indicating possible CSP injection.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        response_headers|contains: "Content-Security-Policy"
    filter:
        response_headers|contains: "script-src"
    condition: selection and count(filter) > 1
falsepositives:
    - Legitimate use of multiple script-src directives (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54133 - Potential CSP Injection in Rails Response"; flow:to_client; content:"Content-Security-Policy"; http_header; pcre:"/script-src[^;]*script-src/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Action Pack: Upgrade to the patched versions:
   • Rails 7.0.x: Update to 7.0.8.7 or later
   • Rails 7.1.x: Update to 7.1.5.1 or later
   • Rails 7.2.x: Update to 7.2.2.1 or later
   • Rails 8.0.x: Update to 8.0.0.1 or later Run:

   bundle update actionpack
   

2. Sanitize Input: If immediate update is not possible, sanitize all user input used in CSP helpers:

   def sanitize_csp_source(source)
     source.gsub(/[;,]/, '')
   end
   

3. Audit Code: Review all uses of content_security_policy in the application for dynamic input.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) rule to block CSP headers with multiple script-src directives.
• Use static analysis tools (e.g., Brakeman) to detect unsafe CSP construction.
• Enforce a strict Content Security Policy that does not rely on user input.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.