Directive injection when using dynamic overrides with user input in RubyGems secure_headers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-95.
Summary
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| secure_headers | before 3.8.0; 5.0.0 to before 5.1.0; 6.0.0 to before 6.2.0 | 3.8.0, 5.1.0, 6.2.0 | Patch available | CNA | |
| — | secure_headers (RubyGems) | 6.0.0 to before 6.2.0 | 6.2.0 | Patch available | GHSA-xq52-rv6w-397c |
| — | secure_headers (RubyGems) | 5.0.0 to before 5.1.0 | 5.1.0 | Patch available | GHSA-xq52-rv6w-397c |
| — | secure_headers (RubyGems) | before 3.8.0 | 3.8.0 | Patch available | GHSA-xq52-rv6w-397c |
- secure_headers VendorTwitter Affected before 3.8.0; 5.0.0 to before 5.1.0; 6.0.0 to before 6.2.0 Fixed in 3.8.0, 5.1.0, 6.2.0 Patch available CNA
- secure_headers (RubyGems) Vendor— Affected 6.0.0 to before 6.2.0 Fixed in 6.2.0 Patch available GHSA-xq52-rv6w-397c
- secure_headers (RubyGems) Vendor— Affected 5.0.0 to before 5.1.0 Fixed in 5.1.0 Patch available GHSA-xq52-rv6w-397c
- secure_headers (RubyGems) Vendor— Affected before 3.8.0 Fixed in 3.8.0 Patch available GHSA-xq52-rv6w-397c
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:* | before 3.8.0; 5.0.0 to before 5.1.0; 6.0.0 to before 6.2.0 | Vulnerable |
- cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:* Versions before 3.8.0; 5.0.0 to before 5.1.0; 6.0.0 to before 6.2.0 Vulnerable ·Twitter
Remediation
- Fix · CNA secure_headers (Twitter) Fixed in 3.8.0, 5.1.0, 6.2.0
- Fix · GHSA-xq52-rv6w-397c secure_headers (RubyGems) Fixed in 6.2.0 Advisory →
- Fix · GHSA-xq52-rv6w-397c secure_headers (RubyGems) Fixed in 5.1.0 Advisory →
- Fix · GHSA-xq52-rv6w-397c secure_headers (RubyGems) Fixed in 3.8.0 Advisory →
Red Hat 1 advisory
- RHSA-2020:4366 Released 2020-10-27 · Red Hat rating ImportantSatellite 6.8 release
- Red Hat Satellite 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
- Red Hat Satellite Capsule 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6.8 | Fixed | RHSA-2020:4366 |
| Red Hat Satellite Capsule 6.8 | Fixed | RHSA-2020:4366 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5217
- 2026-10-03 Alias added: GHSA-xq52-rv6w-397c
References
Advisory 3
More Twitter Secure Headers vulnerabilities
- TI-2020-04272 Limited header injection when using dynamic overrides with user input in RubyGems secure_headers CVSS 3.1MEDIUM 5.8
Sources
- CVE-2020-5217 · CVE Program
- CVE-2020-5217 · NVD
- FIRST EPSS
- GHSA-xq52-rv6w-397c · GitHub Advisory Database · CC BY 4.0
- CVE-2020-5217 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences