Impact

ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer html_safe? (for example, one mutated in place with gsub!) is restored as html_safe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS.

Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.action_dispatch.cookies_serializer = :message_pack or :message_pack_allow_marshal, or serializer: :message_pack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected.

Details

The fixed releases serialize a SafeBuffer that is not html_safe? with a marker and deserialize it as a String; a SafeBuffer that is html_safe? keeps the existing format. Versions without the fix cannot read an unsafe buffer serialized by the fixed releases, so during a rolling deploy a cookie or cache entry holding one could fail to load on a process that has not been upgraded.

Workarounds

Applications that cannot upgrade can convert a SafeBuffer to a String with to_str before storing it in a value that a MessagePack serializer writes.

Releases

The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:

• 8.1: https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7.patch

Credit

This issue was responsibly reported by HackerOne researcher jcwilk.