CVE-2024-27285: 
Ruby vulnerability analysis and mitigation

CVE-2024-27285 affects YARD, a Ruby Documentation tool. The vulnerability was discovered in the 'frames.html' file within the Yard Doc's generated documentation, which is susceptible to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the 'frames.erb' template file. The vulnerability was disclosed on February 28, 2024, and affects all versions prior to 0.9.36 (GitHub Advisory, NVD).

The vulnerability stems from mishandling user-controlled data retrieved from the URL hash in the embedded JavaScript code within the 'frames.erb' template file. The CVSS v3.1 base score is 6.1 (Medium) according to NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The issue specifically relates to inadequate sanitization of the hash data before it's used to establish the top-level window's location (GitHub Advisory).

The XSS vulnerability enables attackers to execute arbitrary JavaScript code within the user's session context. Potential consequences include session hijacking, theft of sensitive data, unauthorized access to user accounts, and website defacement. Any user visiting a compromised page generated by affected YARD versions is susceptible to exploitation (GitHub Advisory).

The vulnerability can be exploited by gaining access to the generated Yard Doc, locating the 'frames.html' file, and constructing a URL containing a malicious payload in the hash segment. For version 0.9.34, the exploit uses the format '#!javascript:xss', and for version 0.9.35, it uses '#:javascript:xss' (GitHub Advisory).

The vulnerability has been fixed in YARD version 0.9.36. Users are strongly advised to upgrade to this version or later. Multiple distributions have also released security updates, including Debian with version 0.9.16-1+deb10u1 for Debian 10 and Fedora with version 0.9.36-1.fc38 for Fedora 38 (Debian LTS, Fedora Update).