CVE-2024-37031: Stored Persistent Cross-Site Scripting (XSS) in ActiveAdmin
Summary
CVE-2024-37031: activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends. Affects activeadmin across 2 version ranges.
< 3.2.2
>= 4.0.0.beta1, < 4.0.0.beta7
Fixed in 3.2.2 or 4.0.0.beta7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ActiveAdmin is a RubyGem that provides a framework for creating administration interfaces. It is commonly used to build private backends for web applications, allowing administrators to manage entities and perform administrative tasks. The vulnerability in ActiveAdmin allows for stored persistent cross-site scripting (XSS) attacks in dynamic form legends. This means that if the form legends are set dynamically and can be manipulated by a malicious user, they can inject and execute arbitrary JavaScript code in the browser of the ActiveAdmin administrator. This can lead to unauthorized access, data theft, and other malicious activities.
Vulnerability Detail
The vulnerability arises from the way ActiveAdmin handles form legends. If the name of the form legend is set dynamically and can be controlled by a non-admin user, it becomes possible for an attacker to inject malicious JavaScript code. This can happen when the form legend value is derived from an attribute of the resource being edited. By creating an entity with a specially crafted name, an attacker can execute arbitrary code in the browser of the ActiveAdmin administrator. The impact of this vulnerability can be severe, as it allows for unauthorized access, data manipulation, and other malicious actions.
How To Fix
Latest published version: 3.5.2 as of 23 Oct 2026
gem install activeadmin -v 3.5.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.2.23.2.2gem install activeadmin -v 3.2.2 -
>= 4.0.0.beta1, < 4.0.0.beta74.0.0.beta7gem install activeadmin -v 4.0.0.beta7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the vulnerability without upgrading, the form name can be explicitly escaped using an HTML escaping utility. This ensures that any user-controlled input is properly sanitized and prevents the execution of injected JavaScript code. The following code snippet demonstrates the implementation of the workaround:
form do |f|
f.inputs name: ERB::Util.html_escape(resource.name) do
f.input :name
f.input :description
end
f.actions
end
Conclusion
The stored persistent cross-site scripting (XSS) vulnerability in ActiveAdmin can have severe consequences, including unauthorized access, data theft, and other malicious activities. It is crucial to address this vulnerability promptly by upgrading to ActiveAdmin versions 3.2.2 or 4.0.0.beta7. If upgrading is not immediately feasible, implementing the provided workaround by explicitly escaping the form name can mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for activeadmin →
FAQ
The vulnerability allows for stored persistent cross-site scripting (XSS) attacks in ActiveAdmin. This means that an attacker can inject and execute arbitrary JavaScript code in the browser of the ActiveAdmin administrator. This can lead to unauthorized access, data theft, and other malicious activities.
The vulnerability has been fixed in ActiveAdmin versions 3.2.2 and 4.0.0.beta7. Upgrading to one of these versions is the recommended solution. If upgrading is not immediately feasible, a workaround can be implemented by explicitly escaping the form name using an HTML escaping utility.
Yes, a workaround can be implemented without upgrading. The workaround involves explicitly escaping the form name using an HTML escaping utility. This ensures that any user-controlled input is properly sanitized and prevents the execution of injected JavaScript code.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to address the vulnerability promptly to prevent potential attacks.
You can find more information about stored XSS attacks and their impact on the OWASP website: https://owasp.org/www-community/attacks/xss/#stored-xss-attacks
References
Related vulnerabilities
Recent vulnerabilities recorded for activeadmin.
