CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7497-1 advisory.

    Rikita Ishikawa discovered that CarrierWave did not correctly sanitize certain inputs. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2021-21305)

    Norihide Saito discovered that CarrierWave did not correctly sanitize certain inputs. An attacker could     possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2023-49090)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave     has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in     `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the     `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-     Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in     versions 2.2.5 and 3.0.5. (CVE-2023-49090)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave
    has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in
    `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the
    `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-
    Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in
    versions 2.2.5 and 3.0.5. (CVE-2023-49090)

ID	Name	Product	Family	Severity
235428	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : CarrierWave vulnerabilities (USN-7497-1)	Nessus	Ubuntu Local Security Checks	high
226213	Linux Distros Unpatched Vulnerability : CVE-2023-49090	Nessus	Misc.	medium
415380	SCA: security update for carrierwave (GHSA-gxhx-g4fq-49hj)	Tenable Cloud Security	SCA Checks	medium
415380	SCA: security update for carrierwave (GHSA-gxhx-g4fq-49hj)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2023-49090

medium

Tenable Plugins

high

medium

medium

medium