{"id":"GHSA-9mg6-x45v-hcfm","summary":"activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends","details":"### Impact\n\nUsers settings their active admin form legends dynamically may be vulnerable to stored XSS, as long as its value can be injected directly by a malicious user.\n\nFor example:\n\n* A public web application allows users to create entities with arbitrary names.\n* Active Admin is used to administrate these entities through a private backend.\n* The form to edit these entities in the private backend has the following shape (note the dynamic `name` value dependent on an attribute of the `resource`):\n\n```ruby\n  form do |f|\n    f.inputs name: resource.name do\n      f.input :name\n      f.input :description\n    end\n\n    f.actions\n  end\n```\n\nThen a malicious user could create an entity with a payload that would get executed in the active admin administrator's browser.\n\nBoth `form` blocks with an implicit or explicit name (i.e., both `form resource.name` or `form name: resource.name` would suffer from the problem), where the value of the name can be arbitrarily set by non admin users.\n\n### Patches\n\nThe problem has been fixed in ActiveAdmin 3.2.2 and ActiveAdmin 4.0.0.beta7.\n\n### Workarounds\n\nUsers can workaround this problem without upgrading by explicitly escaping the form name using an HTML escaping utility. For example:\n\n```ruby\n  form do |f|\n    f.inputs name: ERB::Util.html_escape(resource.name) do\n      f.input :name\n      f.input :description\n    end\n\n    f.actions\n  end\n```\nUpgrading is of course recommended though.\n\n### References\nhttps://owasp.org/www-community/attacks/xss/#stored-xss-attacks","aliases":["CVE-2024-37031"],"modified":"2026-07-08T06:53:12.513897950Z","published":"2024-06-02T22:32:24Z","database_specific":{"nvd_published_at":"2024-06-03T06:15:10Z","severity":"HIGH","cwe_ids":["CWE-79"],"github_reviewed_at":"2024-06-02T22:32:24Z","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37031"},{"type":"WEB","url":"https://github.com/activeadmin/activeadmin/pull/8349"},{"type":"PACKAGE","url":"https://github.com/activeadmin/activeadmin"},{"type":"WEB","url":"https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activeadmin/CVE-2024-37031.yml"},{"type":"WEB","url":"https://rubygems.org/gems/activeadmin/versions/3.2.2"}],"affected":[{"package":{"name":"activeadmin","ecosystem":"RubyGems","purl":"pkg:gem/activeadmin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.0.pre","0.5.0.pre1","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","1.0.0","1.0.0.pre1","1.0.0.pre2","1.0.0.pre3","1.0.0.pre4","1.0.0.pre5","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","2.0.0","2.0.0.rc1","2.0.0.rc2","2.1.0","2.10.0","2.10.1","2.11.0","2.11.1","2.11.2","2.12.0","2.13.0","2.13.1","2.14.0","2.2.0","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","2.6.1","2.7.0","2.8.0","2.8.1","2.9.0","3.0.0","3.1.0","3.2.0","3.2.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-9mg6-x45v-hcfm/GHSA-9mg6-x45v-hcfm.json"}},{"package":{"name":"activeadmin","ecosystem":"RubyGems","purl":"pkg:gem/activeadmin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.beta1"},{"fixed":"4.0.0.beta7"}]}],"versions":["4.0.0.beta1","4.0.0.beta2","4.0.0.beta3","4.0.0.beta4","4.0.0.beta5","4.0.0.beta6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-9mg6-x45v-hcfm/GHSA-9mg6-x45v-hcfm.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}