Description
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | paperclip | < 4.2.2 | 4.2.2 | GHSA-6jvm-3j5h-79f6 |
References
- 75304 vdb-entry
- https://robots.thoughtbot.com/paperclip-security-release
- https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57
- JVN#83881261 third-party-advisory
- JVNDB-2015-000088 third-party-advisory
- [oss-security] 20150618 Re: CVE request: Content type spoofing in ruby gem paperclip <4.2.2 mailing-list