GHSA-58rx-96gf-w92x: 
Ruby vulnerability analysis and mitigation

Impact

sort_link and sort_url build the link by passing every request parameter to url_for, removing only host. url_for reads several keys as URL structure rather than as query parameters, so a crafted query string controls the link that every sort link on the page renders. Reflected XSS. url_for prepends script_name and original_script_name to the path without validating them. A link such as https://victim.example/posts?script_name=javascript:alert(document.domain)// makes the page's sort links render as href="javascript:alert(document.domain)//posts?q%5Bs%5D=title+asc". A victim who opens the attacker's link and then clicks a sort link runs the attacker's script in the application's origin. Open redirect. A value-less ?only_path arrives as nil, which skips ActionView's only_path: true default. protocol, domain, subdomain, port, user and password then point the sort links at another origin. Through a routing proxy (sort_link([:main_app, @q], ...)) a full URL is built anyway, so only_path is not needed. Errors. use_route switches the link to another named route, and a non-hash _recall raises TypeError, so the page returns a 500. Any page that renders sort_link or sort_url is affected with the default setup, and the attacker needs no account. The victim has to open the crafted link and then click a sort link. The search itself is unaffected.

Patches

Fixed in 6.0.1, 5.0.3 and 4.4.4. Ransack now drops every key url_for treats as a URL option from the request params before building the link: host, protocol, port, password, subdomain, domain, tld_length, script_name, original_script_name, only_path, trailing_slash, anchor, params, use_route and _recall. A user param is still carried over, because userinfo needs a password as well. Options passed to sort_link explicitly are unaffected.

Workarounds

Until you can upgrade, remove those keys from params before rendering, for example in a before_action.

References

• CVE-2020-11082, the same class of bug in kaminari