CVE-2024-29034

CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained

State: Published
Severity: 6.8 Medium
Published: Mar 24, 2024
Updated: Aug 2, 2024
Reserved: Mar 14, 2024

Description

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-436 Interpretation Conflict
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
carrierwavecarrierwaveuploader	>= 3.0.0, < 3.0.7Affected < 2.2.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.