Skip to content
Threat Feed
Subscribe

Tag

Ruby-on-Rails

2 briefs RSS
high threat

Vulnerability in Ruby on Rails Allows Remote Indirect Code Injection (XSS)

A cross-site scripting (XSS) vulnerability has been discovered in Ruby on Rails versions prior to 1.7.1, enabling a remote attacker to perform an indirect remote code injection, allowing malicious scripts to be executed in the client's browser.

exploited Ruby on Rails < 1.7.1 xss web-vulnerability ruby-on-rails cross-site-scripting
1t 1i
high advisory

Non-Constant-Time HMAC Comparison in Pay Gem Paddle Billing Webhook Signature Verifier

A timing side-channel vulnerability in the `Pay` gem's Paddle Billing webhook signature verification component (`Pay::Webhooks::PaddleBillingController#valid_signature?` <= v11.6.1) allows an unauthenticated attacker to recover the HMAC signing secret by observing response time variations in `String#==` comparisons, enabling the forgery of arbitrary webhook events and leading to business logic abuses such as unauthorized feature provisioning or fraudulent refunds.

pay timing-attack vulnerability webhooks ruby-on-rails server-side logic-error remote-code-execution
3t