Cross-Site Scripting in Kaminari

Root

Cause

The vulnerability resides in the Kaminari pagination gem for Ruby web frameworks. The PARAM_KEY_EXCEPT_LIST constant in kaminari-core/lib/kaminari/helpers/tag.rb defines parameters that are filtered out from pagination URLs. In versions before 1.2.1, the list explicitly excluded :authenticity_token, :commit, :utf8, :_method, and :script_name [4]. The :original_script_name parameter was not included in this exclusion list, meaning it was not sanitized. An attacker could supply a crafted original_script_name value that, when passed through to the pagination link helper, would be rendered unescaped in the HTML output, leading to arbitrary code injection (e.g., XSS or other script injection) [1][4].

Exploitation

No authentication is required; the attack can be performed by any user who can control query parameters in a request that renders pagination links. The vulnerability is triggered when a web application using Kaminari includes the user-supplied original_script_name parameter in the pagination URLs generated for subsequent pages. An attacker simply appends &original_script_name=... with a malicious payload to the current page URL; the Kaminari helper will then reflect that payload into the pagination links without escaping [1][3]. The issue is present in all Kaminari versions prior to 1.2.1.

Impact

Successful exploitation allows an attacker to inject arbitrary JavaScript or other code into pagination links served to other users. This leads to typical XSS impacts: session theft, credential harvesting, arbitrary actions performed on behalf of the victim, and potential full compromise of the web application's client-side security. The CVSS score (version not specified in sources) is likely high because no authentication or special user interaction beyond following a link is required.

Mitigation

The fix was released in Kaminari version 1.2.1 [2][4]. The commit [4] adds :original_script_name to the PARAM_KEY_EXCEPT_LIST, ensuring the parameter is excluded from pagination link generation. Users are strongly advised to upgrade to 1.2.1 or later. If upgrade is not immediately possible, applications can mitigate by stripping the original_script_name parameter from incoming requests via web application firewall rules or custom middleware.