CVE-2024-32463

Summary

CVE-2024-32463 is a newly identified cross-site scripting (XSS) vulnerability affecting the open-source phlex framework used for building object-oriented views in Ruby. Maliciously crafted user data can exploit this issue by bypassing the filter designed to prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag. The bypass technique involves using tab (`\t`) or newline (`\n`) characters between the characters of the protocol. Phlex users are advised to update to versions 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, or 1.4.2 to mitigate this risk. Alternatively, implementing a Content Security Policy that disallows `unsafe-inline` can effectively prevent this vulnerability from being exploited.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.