GHSA-vfmv-jfc5-pjjw CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

• RubyGems carrierwave: >= 3.0.0, < 3.0.7 → fixed in 3.0.7 • RubyGems carrierwave: < 2.2.6 → fixed in 2.2.6

Impact The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Patches Upgrade to 3.0.7 or 2.2.6. Workarounds Use the following monkey patch to let CarrierWave parse the Content-type by using `Marcel::MimeType.for`. ```ruby For CarrierWave 3.x CarrierWave::SanitizedFile.class_eval do def declared_content_type @declared_content_type || if @file.respond_to?(:content_type) && @file.content_type Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp) end end end ``` ```ruby For CarrierWave 2.x CarrierWave::SanitizedFile.class_eval do def existing_content_type if @file.respond_to?(:content_type) && @file.content_type Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp) end end end ``` References OWASP - File Upload Cheat Sheet