Broken Function Level Authorization

Broken Function Level Authorization in Ruby on Rails [CVE-2007-3227]

[Fixed month year] Updated CVE-2007-3227

Overview

CVE-2007-3227 describes an XSS vulnerability in Ruby on Rails via ActiveRecord::Base#to_json before edge 9606. The vulnerability (CWE-79) allowed remote attackers to inject arbitrary web script via input values when JSON was embedded in an HTML response. This occurred because JSON produced by to_json could be placed into HTML/JavaScript contexts without sufficiently escaping potentially dangerous input. In practice, a malicious user could supply crafted input that, when serialized by to_json and inserted into a page (for example inside a script tag or a data attribute), could be executed by the browser, leading to session hijacking, credential theft, or defacement. Remediation emphasizes upgrading Rails to a fixed release (edge 9606 or later) and adopting safe rendering practices. Do not render raw JSON into HTML or JavaScript contexts; instead, escape JSON for JavaScript with json_escape or Rails' j helper, and validate/sanitize user input. This approach mitigates the specific risk described in CVE-2007-3227 and reduces exposure to similar XSS vectors in Rails apps.

Affected Versions

Rails before edge 9606

Code Fix Example

Ruby on Rails API Security Remediation
Vulnerable:
<script>
  var payload = <%= @payload.to_json %>;
</script>

Fixed:
<script>
  var payload = <%= j @payload.to_json %>;
</script>

CVE References

Choose which optional cookies to allow. You can change this any time.