CVE-2024-29034: CarrierWave content-Type allowlist bypass vulnerability leading to XSS

Background

CarrierWave is a RubyGem that provides a simple and efficient way to upload files from web applications to various storage services, including Amazon S3. It is widely used in Ruby on Rails applications to handle file uploads. The vulnerability in CarrierWave allows an attacker to bypass the content type allowlist and potentially execute cross-site scripting (XSS) attacks. This can lead to the injection of malicious code into web pages and compromise the security of the application.

Vulnerability Detail

The vulnerability arises from the ability to set a Content-Type value during file uploads that is different from what is allowed by the content_type_allowlist configuration. By providing multiple values separated by commas, an attacker can bypass the allowlist and upload files with malicious content types. This can be exploited to execute XSS attacks, where the injected code is executed by the victim's browser. This vulnerability has a CVSS score of 6.8, indicating a moderate level of severity.

gem install carrierwave -v 3.1.4

Workaround

If upgrading to the patched versions is not immediately feasible, a temporary workaround can be implemented using a monkey patch. The following code can be added to the application to parse the Content-Type using Marcel::MimeType.for:

# For CarrierWave 3.x
CarrierWave::SanitizedFile.class_eval do
  def declared_content_type
    @declared_content_type ||
      if @file.respond_to?(:content_type) && @file.content_type
        Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)
      end
  end
end

# For CarrierWave 2.x
CarrierWave::SanitizedFile.class_eval do
  def existing_content_type
    if @file.respond_to?(:content_type) && @file.content_type
      Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)
    end
  end
end

This workaround ensures that the Content-Type is correctly parsed and validated, mitigating the risk of the vulnerability.

Conclusion

The CarrierWave content-Type allowlist bypass vulnerability poses a risk of XSS attacks and compromise of web application security. It is crucial to upgrade to the patched versions or apply the provided workaround to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for carrierwave →

FAQ