CVE-2020-16254: 
Ruby vulnerability analysis and mitigation

The Chartkick gem through version 3.3.2 for Ruby contains a CSS Injection vulnerability (CVE-2020-16254) that was discovered on August 4, 2020. The vulnerability affects the width and height options of the charting library, where user input can be used to inject malicious CSS properties (GitHub Issue).

The vulnerability exists because Chartkick uses ERB::Util.html_escape to escape the width and height parameters, which prevents XSS but does not escape semicolons. This allows attackers to inject additional CSS properties by adding semicolons after valid width/height values. The vulnerability has a CVSS v3.1 base score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) (NVD).

An attacker can exploit this vulnerability by passing malicious input to the width or height options of Chartkick charts. For example, they could inject additional CSS properties like background-image to load external resources: width: "100%; background-image: url('http://example.com/image.png')" (GitHub Issue).

The vulnerability can be exploited when user input is passed directly to the width or height options of Chartkick charts. For example: <%= line_chart data, width: params[:width], height: params[:height] %>. The attack requires no special privileges but does require user interaction (GitHub Issue).

The vulnerability was fixed in Chartkick version 3.4.0 by limiting width and height values to only alphanumeric characters and the % symbol. While this prevents some valid values like calc(), it provides better security. All users running affected versions should upgrade to version 3.4.0 or later (GitHub Issue).