Rubysec

Providing security resources for the Ruby community.
Follow us @rubysec or email us via info at rubysec.com

Advisory Archive

Back

---
gem: geminabox
date: 2017-11-10
url: https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md#01310-2017-11-13
cve: 2017-16792
title: Stored XSS in "geminabox" via injection in Gemspec "homepage" value
description: |
  Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem
  in a Box) allows attackers to inject arbitrary web script via a crafted
  JavaScript URL in the "homepage" value of a ".gemspec" file.

  A ".gemspec" file must be created with a JavaScript URL in the homepage
  value. This can be used to build a gem for upload to the Geminabox server,
  in order to achieve stored XSS via the gem hyperlink.
patched_versions:
- ">= 0.13.10"
related:
  url: '["https://github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7",
    "https://github.com/geminabox/geminabox/commit/e7e0b16147677e9029f0b55eff6bc6dda52398d4"]'