GHSA SYNC: 1 brand new advisory

Author: jasnow

gems/activeadmin/CVE-2024-37031.yml

@@ -0,0 +1,77 @@
+---
+gem: activeadmin
+cve: 2024-37031
+ghsa: 9mg6-x45v-hcfm
+url: https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm
+title: activeadmin vulnerable to stored persistent cross-site
+  scripting (XSS) in dynamic form legends
+date: 2024-06-02
+description: |
+  ### Impact
+
+  Users settings their active admin form legends dynamically may be
+  vulnerable to stored XSS, as long as its value can be injected
+  directly by a malicious user.
+
+  For example:
+
+  * A public web application allows users to create entities with
+    arbitrary names.
+  * Active Admin is used to administrate these entities through a
+    private backend.
+  * The form to edit these entities in the private backend has the
+    following shape (note the dynamic `name` value dependent on an
+    attribute of the `resource`):
+
+  ```ruby
+    form do |f|
+      f.inputs name: resource.name do
+        f.input :name
+        f.input :description
+      end
+
+      f.actions
+    end
+  ```
+
+  Then a malicious user could create an entity with a payload that
+  would get executed in the active admin administrator's browser.
+
+  Both `form` blocks with an implicit or explicit name (i.e., both
+  `form resource.name` or `form name: resource.name` would suffer
+  from the problem), where the value of the name can be arbitrarily
+  set by non admin users.
+
+  ### Patches
+
+  The problem has been fixed in ActiveAdmin 3.2.2 and ActiveAdmin 4.0.0.beta7.
+
+  ### Workarounds
+
+  Users can workaround this problem without upgrading by explicitly
+  escaping the form name using an HTML escaping utility. For example:
+
+  ```ruby
+    form do |f|
+      f.inputs name: ERB::Util.html_escape(resource.name) do
+        f.input :name
+        f.input :description
+      end
+
+      f.actions
+    end
+  ```
+  Upgrading is of course recommended though.
+
+  ### References
+  https://owasp.org/www-community/attacks/xss/#stored-xss-attacks
+cvss_v3: 7.2
+patched_versions:
+  - "~> 3.2.2"
+  - ">= 4.0.0.beta7"
+related:
+  url:
+    - https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm
+    - https://github.com/activeadmin/activeadmin/pull/8349
+    - https://owasp.org/www-community/attacks/xss/#stored-xss-attacks
+    - https://github.com/advisories/GHSA-9mg6-x45v-hcfm