Updated advisory posts against rubysec/ruby-advisory-db@26ec365

Author: jasnow

advisories/_posts/2024-02-28-CVE-2024-27285.md

@@ -0,0 +1,71 @@
+---
+layout: advisory
+title: 'CVE-2024-27285 (yard): YARD''s default template vulnerable to Cross-site Scripting
+  in generated frames.html'
+comments: false
+categories:
+- yard
+advisory:
+  gem: yard
+  cve: 2024-27285
+  ghsa: 8mq4-9jjh-9xrc
+  url: https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
+  title: YARD's default template vulnerable to Cross-site Scripting in generated frames.html
+  date: 2024-02-28
+  description: |2
+
+    ### Summary
+
+    The "frames.html" file within the Yard Doc's generated documentation
+    is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate
+    sanitization of user input within the JavaScript segment of the
+    "frames.erb" template file.
+
+    ### Details
+
+    The vulnerability stems from mishandling user-controlled data retrieved
+    from the URL hash in the embedded JavaScript code within the "frames.erb"
+    template file. Specifically, the script lacks proper sanitization of
+    the hash data before utilizing it to establish the top-level window's
+    location. This oversight permits an attacker to inject malicious
+    JavaScript payloads through carefully crafted URLs.
+
+    Snippet from "frames.erb":
+    ```erb
+    <script type="text/javascript">
+      var match = unescape(window.location.hash).match(/^#!(.+)/);
+      var name = match ? match[1] : '<= url_for_main >';
+      name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
+      window.top.location = name;
+    </script>
+    ```
+
+    ### PoC (Proof of Concept)
+
+    To exploit this vulnerability:
+    1. Gain access to the generated Yard Doc.
+    2. Locate and access the "frames.html" file.
+    3. Construct a URL containing the malicious payload in the hash
+       segment, for instance: `#!javascript:xss`
+
+    ### Impact
+
+    This XSS vulnerability presents a substantial threat by enabling
+    an attacker to execute arbitrary JavaScript code within the user's
+    session context. Potential ramifications include session hijacking,
+    theft of sensitive data, unauthorized access to user accounts, and
+    defacement of websites. Any user visiting the compromised page is
+    susceptible to exploitation. It is critical to promptly address
+    this vulnerability to mitigate potential harm to users and preserve
+    the application's integrity.
+  cvss_v3: 5.4
+  patched_versions:
+  - ">= 0.9.35"
+  related:
+    url:
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27285
+    - https://github.com/lsegal/yard/releases/tag/v0.9.35
+    - https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
+    - https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
+    - https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
+---