Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Phlex Framework Allows Malicious Code Injection via User Data

CVE-2024-32463 · published 2 years ago
Summary

Using malicious data input, an attacker could inject code into a website built with the Phlex framework, potentially allowing them to steal user data or take control of the website. This vulnerability affects websites using outdated versions of the Phlex framework. To fix the issue, update to the latest version of Phlex or configure a Content Security Policy to block inline scripts.

What to do
  • Update joel drapper phlex to version 1.10.1.
  • Update joel drapper phlex to version 1.9.2.
  • Update joel drapper phlex to version 1.8.3.
  • Update joel drapper phlex to version 1.7.2.
  • Update joel drapper phlex to version 1.6.3.
  • Update joel drapper phlex to version 1.5.3.
  • Update joel drapper phlex to version 1.4.2.
Affected software
Ecosystem VendorProductAffected versions
rubygems joel drapper phlex 1.10.0
>= 1.9.0, < 1.9.2
>= 1.8.0, < 1.8.3
>= 1.7.0, < 1.7.2
>= 1.6.0, < 1.6.3
>= 1.5.0, < 1.5.3
< 1.4.2
Fix: upgrade to 1.10.1
Original advisory text
phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
CWE-87Improper Neutralization of Alternate XSS Syntax
Timeline
Published17 Apr 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-g7xq-xv8c-h98c · GHSA
CVE-2024-32463 · NVD
CVE-2024-32463 · OSV
Track software like this
Free during beta