CVE-2010-0541

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the WEBrick HTTP server included with Ruby on Apple Mac OS X versions 10.5.8 and 10.6 before 10.6.4. The flaw is triggered when a crafted URI is sent to the server, causing it to return an error page that interprets the URI as UTF-7 encoded content, allowing injection of arbitrary web script or HTML [1]. This issue also affects Ruby on other platforms; Red Hat issued updates for Ruby on Red Hat Enterprise Linux via RHSA-2011-0909 and RHSA-2011-0908 [2][3].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to a WEBrick server. No authentication or special privileges are required; the attacker only needs network access to the server. The server's error page will reflect the malicious input in a way that the browser interprets as UTF-7, enabling script execution.

Impact

Successful exploitation allows an attacker to inject arbitrary web script or HTML into the error page served by WEBrick. This can lead to session hijacking, defacement, or theft of sensitive data in the context of the affected web application.

Mitigation

Apple addressed this issue in Security Update 2010-004 / Mac OS X v10.6.4 [1]. Red Hat released updated Ruby packages in RHSA-2011-0909 and RHSA-2011-0908 [2][3]. Users should apply the appropriate updates for their operating system. No workaround is documented.