TI-2024-19216 Aliases CVE-2024-29034 GHSA-vfmv-jfc5-pjjw

CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained

LOW 30CWE-436Published 2024-03-24 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0044 38th percentileScored 2026-11-07

Fix Fixed carrierwave (carrierwaveuploader): 3.0.7, 2.2.6carrierwave (RubyGems): 3.0.7, 2.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
carrierwaveuploader	carrierwave	3.0.0 to before 3.0.7; before 2.2.6	3.0.7, 2.2.6	Patch available	CNA
—	carrierwave (RubyGems)	3.0.0 to before 3.0.7	3.0.7	Patch available	GHSA-vfmv-jfc5-pjjw
—	carrierwave (RubyGems)	before 2.2.6	2.2.6	Patch available	GHSA-vfmv-jfc5-pjjw

carrierwave Vendorcarrierwaveuploader Affected 3.0.0 to before 3.0.7; before 2.2.6 Fixed in 3.0.7, 2.2.6 Patch available CNA
carrierwave (RubyGems) Vendor— Affected 3.0.0 to before 3.0.7 Fixed in 3.0.7 Patch available GHSA-vfmv-jfc5-pjjw
carrierwave (RubyGems) Vendor— Affected before 2.2.6 Fixed in 2.2.6 Patch available GHSA-vfmv-jfc5-pjjw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:carrierwave_project:carrierwave::::::ruby::*	before 2.2.6; 3.0.0 to before 3.0.7	Vulnerable	carrierwaveuploader

cpe:2.3:a:carrierwave_project:carrierwave:*:*:*:*:*:ruby:*:* Versions before 2.2.6; 3.0.0 to before 3.0.7 Vulnerable ·carrierwaveuploader

Remediation

Fix · CNA carrierwave (carrierwaveuploader) Fixed in 3.0.7, 2.2.6
Fix · GHSA-vfmv-jfc5-pjjw carrierwave (RubyGems) Fixed in 3.0.7 Advisory →
Fix · GHSA-vfmv-jfc5-pjjw carrierwave (RubyGems) Fixed in 2.2.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-29034
2026-10-03 Alias added: GHSA-vfmv-jfc5-pjjw

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-29034

Other 2

TI-2026-32499 CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters CVSS 3.1MEDIUM 6.1
TI-2021-04405 Code Injection vulnerability in CarrierWave CVSS 3.1HIGH 8.8
TI-2023-26755 CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS CVSS 3.1MEDIUM 6.8
TI-2021-04388 Server-side request forgery in CarrierWave CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences