CVE-2023-28362
📋 TL;DR
This vulnerability in Ruby on Rails allows attackers to inject malicious characters into redirect URLs via the redirect_to method. When downstream services enforce RFC compliance on HTTP headers, they may strip the Location header entirely, potentially enabling cross-site scripting (XSS) attacks. All Rails applications using the redirect_to method with user-supplied values are affected.
💻 Affected Systems
- Ruby on Rails
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Successful XSS attack leading to session hijacking, credential theft, or complete account compromise.
Likely Case
Partial or complete disruption of redirect functionality, potentially enabling reflected XSS in specific browser configurations.
If Mitigated
Redirects fail or behave unexpectedly, but no security compromise occurs.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) and depends on downstream header validation. Proof-of-concept code is publicly available in advisory discussions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Rails 7.0.4.4 and 6.1.7.7
Vendor Advisory: https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
Restart Required: Yes
Instructions:
1. Update Gemfile to specify patched Rails version (>=7.0.4.4 or >=6.1.7.7). 2. Run 'bundle update rails'. 3. Restart application server. 4. Test redirect functionality.
🔧 Temporary Workarounds
Input Validation Workaround
allValidate and sanitize all user-supplied URLs before passing to redirect_to method
# In controller action:
redirect_to URI.parse(user_input).to_s if valid_redirect?(user_input)
Monkey Patch Fix
allApply temporary patch to sanitize redirect URLs
# In config/initializers/redirect_fix.rb:
module ActionController
module Redirecting
def redirect_to(options = {}, response_options = {})
# Add sanitization logic here
end
end
end
🧯 If You Can't Patch
- Implement strict input validation for all redirect URLs using allowlists of permitted domains
- Deploy WAF rules to block malicious redirect patterns and monitor for suspicious Location headers
🔍 How to Verify
Check if Vulnerable:
Check Rails version with 'bundle show rails' or 'rails --version'. If version is between 5.2.0-7.0.4.3 or 6.1.7.3-6.1.7.6, check if application uses redirect_to with user input.Check Version:
rails --version # or bundle show railsVerify Fix Applied:
Verify Rails version is >=7.0.4.4 or >=6.1.7.7. Test redirect functionality with various inputs to ensure Location headers are properly formed.📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in application logs
- Failed redirect attempts with malformed URLs
- Multiple redirects to unexpected domains
Network Indicators:
- HTTP responses with missing or malformed Location headers
- Redirects containing unusual characters in URLs
SIEM Query:
source="rails.log" AND "redirect_to" AND ("\n" OR "\r" OR "\0")🔗 References
- https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
- https://github.com/advisories/GHSA-4g8v-vg43-wpgf
- https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441
- https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5
- https://security.netapp.com/advisory/ntap-20250502-0009/
