CVE-2024-28103: 
Ruby vulnerability analysis and mitigation

Action Pack, a framework for handling and responding to web requests, contains a vulnerability identified as CVE-2024-28103. Since version 6.1.0, the application configurable Permissions-Policy header was only being served on responses with HTML-related Content-Type. This security issue affects versions from 6.1.0 up to (excluding) 6.1.7.8, 7.0.0 up to (excluding) 7.0.8.4, and 7.1.0 up to (excluding) 7.1.3.4 (NVD, GitHub Advisory).

The vulnerability stems from a limitation where the Permissions-Policy header was only being applied to HTML content types, excluding other content types that could benefit from this security header. The issue has received a CVSS v3.1 base score of 9.8 (CRITICAL) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while GitHub assessed it with a score of 5.4 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (NVD).

The vulnerability affects responses with non-HTML Content-Types, which are not serving the configured Permissions-Policy. This impacts various content types that would benefit from having the Permissions-Policy enforced, such as image/svg+xml and application/xml (GitHub Advisory).

The vulnerability can be exploited in scenarios where non-HTML content types require Permissions-Policy headers for security enforcement. The issue is particularly concerning as it affects all responses with non-HTML Content-Types, potentially exposing them to security risks that the Permissions-Policy header was designed to prevent (GitHub Advisory).

The vulnerability has been fixed in versions 6.1.7.8, 7.0.8.4, and 7.1.3.4. Users are advised to upgrade to these patched versions. The fix involves modifying the framework to include the Permissions-Policy header on all content types, not just HTML-related ones (GitHub Advisory).