Ruby on Rails - HackerOne Reports
View on HackerOne56
Total Reports
0
Critical
14
High
23
Medium
7
Low
ActionController::Parameters .each returns an unsafe hash
Reported by:
abuisman
|
Disclosed:
Medium
Untrusted users able to run pending migrations in production
Reported by:
tenderlove
|
Disclosed:
Medium
Weakness: Uncontrolled Resource Consumption
HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection.
Reported by:
tktech
|
Disclosed:
Low
Weakness: Open Redirect
Escape Sequence Injection vulnerability in Rack
Reported by:
vairelt
|
Disclosed:
Medium
Remote code execution using render :inline
Reported by:
kratob2
|
Disclosed:
Weakness: Code Injection
Bounty: $1500.00
The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routes
Reported by:
jregele
|
Disclosed:
Medium
Weakness: Cross-Site Request Forgery (CSRF)
XSS by file (Active Storage `Proxying`)
Reported by:
ooooooo_q
|
Disclosed:
Medium
Weakness: Cross-site Scripting (XSS) - Stored
Bounty: $500.00
XSS due to incomplete JS escaping
Reported by:
jessecampos
|
Disclosed:
Low
Weakness: Cross-site Scripting (XSS) - Generic
Regular expression denial of service in ActiveRecord's PostgreSQL Money type
Reported by:
dee-see
|
Disclosed:
Medium
Weakness: Uncontrolled Resource Consumption
Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability.
Reported by:
meowday
|
Disclosed:
Medium
Weakness: Cross-site Scripting (XSS) - Reflected
Prevent XSS when passing a parameter directly into link_to
Reported by:
speleding
|
Disclosed:
Low
Weakness: Cross-site Scripting (XSS) - DOM
File writing by Directory traversal at actionpack-page_caching and RCE by it
Reported by:
ooooooo_q
|
Disclosed:
High
Weakness: Path Traversal
Bounty: $1000.00
redirect_to(["string"]) remote code execution
Reported by:
gmcgibbon
|
Disclosed:
Low
Weakness: Information Exposure Through an Error Message
CSRF header is sent to external websites when using data-remote forms
Reported by:
mastahyeti
|
Disclosed:
Low
Weakness: Cross-Site Request Forgery (CSRF)
CVEs:
CVE-2015-1840
Missing resource identifier encoding may lead to security vulnerabilities
Reported by:
jobert
|
Disclosed:
Medium
Weakness: Information Disclosure
Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypass
Reported by:
joernchen
|
Disclosed:
Argument/Code Injection via ActiveStorage's image transformation functionality
Reported by:
gquadros_
|
Disclosed:
High
Weakness: Code Injection
Server-side template injection at ujs test server
Reported by:
ooooooo_q
|
Disclosed:
Weakness: Command Injection - Generic
ActionView sanitize helper bypass leading to XSS using SVG tag.
Reported by:
haqpl
|
Disclosed:
Medium
Weakness: Cross-site Scripting (XSS) - Generic
Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookies
Reported by:
fletchto99
|
Disclosed:
Low
Weakness: Reliance on Cookies without Validation and Integrity Checking in a Security Decision