CVE-2020-5216

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.

CVSS v3 5.8 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0	Patch
https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:twitter:secure_headers::::::ruby::*
	cpe:2.3:a:twitter:secure_headers::::::ruby::*
	cpe:2.3:a:twitter:secure_headers::::::ruby::*

History

No history.

Information

Published : 2020-01-23 03:15

Updated : 2023-12-10 13:13

NVD link : CVE-2020-5216

Mitre link : CVE-2020-5216

CVE.ORG link : CVE-2020-5216

JSON object : View

Products Affected

twitter

secure_headers

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

{"id": "CVE-2020-5216", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.3}]}, "published": "2020-01-23T03:15:10.683", "references": [{"url": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0."}, {"lang": "es", "value": "En Secure Headers (secure_headers de RubyGem), una vulnerabilidad de inyecci\u00f3n de directiva est\u00e1 presente en las versiones anteriores a 3.9.0, 5.2.0 y 6.3.0. Si la entrada suministrada por el usuario fue pasada a append/override_content_security_policy_directives, una l\u00ednea nueva podr\u00eda ser inyectada conllevando a una inyecci\u00f3n de encabezado limitada. Al visualizar una nueva l\u00ednea en el encabezado, rails crear\u00e1 silenciosamente un nuevo encabezado Content-Security-Policy con el valor restante de la cadena original. Continuar\u00e1 creando nuevos encabezados para cada nueva l\u00ednea. Esto ha sido corregido en las versiones 6.3.0, 5.2.0 y 3.9.0."}], "lastModified": "2020-02-18T14:58:04.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "A7C8E5CD-3CF2-439D-991F-EC4F561AF149", "versionEndExcluding": "3.9.0"}, {"criteria": "cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "8EE2D852-886F-4500-8B6A-6CD4313BE0A6", "versionEndExcluding": "5.2.0", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "4C13DFD4-1B3B-4373-9048-82BBB0C594C9", "versionEndExcluding": "6.3.0", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}