In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server,     characters like < >  ' must be escaped properly. In this case, the ' character was missed. An attacker     can manipulate the input to introduce additional attributes, potentially executing code.
    (CVE-2017-1002201)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server,
    characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker
    can manipulate the input to introduce additional attributes, potentially executing code.
    (CVE-2017-1002201)

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2864 advisory.

  - In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server,     characters like < >  ' must be escaped properly. In this case, the ' character was missed. An attacker     can manipulate the input to introduce additional attributes, potentially executing code.
    (CVE-2017-1002201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202007-27 (Haml: Arbitrary code execution)

    It was discovered that Haml was not correctly filtering out special       characters which may be used for attributes.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

In haml, when using user input to perform tasks on the server, characters like < > ' ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.

For Debian 8 'Jessie', this problem has been fixed in version 4.0.5-2+deb8u1.

We recommend that you upgrade your ruby-haml packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
257654	Linux Distros Unpatched Vulnerability : CVE-2017-1002201	Nessus	Misc.	medium
422674	SCA: security update for haml (GHSA-r53w-g4xm-3gc6)	Tenable Cloud Security	SCA Checks	medium
422674	SCA: security update for haml (GHSA-r53w-g4xm-3gc6)	Tenable Self-Hosted Container Security	SCA Checks	medium
156384	Debian DLA-2864-1 : ruby-haml - LTS security update	Nessus	Debian Local Security Checks	medium
138950	GLSA-202007-27 : Haml: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
130771	Debian DLA-1986-1 : ruby-haml security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-1002201

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium