{"id":"CVE-2020-5217","published":"2020-01-23T02:15:17Z","modified":"2024-08-04T08:22:08Z","title":"Directive injection when using dynamic overrides with user input in RubyGems secure_headers","vendor":"Twitter","product":"secure_headers","tier":"core","eol":null,"affectedVersions":[{"vendor":"Twitter","product":"secure_headers","versions":["< 3.8.0",">= 5.0.0, < 5.1.0",">= 6.0.0, < 6.2.0"]}],"description":{"text":"In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0183,"percentile":0.78862,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-95","name":"Improper Neutralization of Directives in Dynamically Evaluated Code"}],"references":[{"url":"https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/twitter/secure_headers/issues/418","tags":["x_refsource_MISC"]},{"url":"https://github.com/twitter/secure_headers/pull/421","tags":["x_refsource_MISC"]},{"url":"https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"},{"id":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"secondary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[{"ecosystem":"RubyGems","package":"secure_headers","vulnerableRanges":[">=6.0.0, <6.2.0",">=5.0.0, <5.1.0","<3.8.0"],"patched":["6.2.0","5.1.0","3.8.0"],"from":["GHSA-xq52-rv6w-397c"],"provenance":"source"}],"advisories":[{"id":"GHSA-xq52-rv6w-397c","url":"https://github.com/advisories/GHSA-xq52-rv6w-397c","severity":"MODERATE","ecosystem":"RubyGems","package":"secure_headers","vulnerableRanges":[">=6.0.0, <6.2.0"],"patched":["6.2.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xq52-rv6w-397c","url":"https://github.com/advisories/GHSA-xq52-rv6w-397c","severity":"MODERATE","ecosystem":"RubyGems","package":"secure_headers","vulnerableRanges":[">=5.0.0, <5.1.0"],"patched":["5.1.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xq52-rv6w-397c","url":"https://github.com/advisories/GHSA-xq52-rv6w-397c","severity":"MODERATE","ecosystem":"RubyGems","package":"secure_headers","vulnerableRanges":["<3.8.0"],"patched":["3.8.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0283","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0283","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1185"],"provenance":"source"}],"timeline":[{"date":"2020-01-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-5217","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":18.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.77,"detail":"percentile 0.7886"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.08,"detail":"base score 4.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-5217","published":"2020-01-23","fixed":"6.2.0","kev":false},{"cve":"CVE-2020-5216","published":"2020-01-23","fixed":"6.3.0","kev":false,"link":{"from":"CVE-2020-5217","to":"CVE-2020-5216","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:secure_headers","fromFixed":"6.2.0","toFixed":"6.3.0","daysApart":0},{"kind":"version-step","provenance":"source","package":"RubyGems:secure_headers","fromFixed":"5.1.0","toFixed":"5.2.0","daysApart":0},{"kind":"similar","provenance":"machine","score":0.36,"basis":"same product + description similarity"}]}},{"cve":"CVE-2026-54163","published":"2026-07-17","fixed":"7.3.0","kev":false}],"package":"RubyGems:secure_headers"}}