CVE-2020-5216: Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
Vulnerability summary
CVE-2020-5216 is a medium (CVSS 5.8) vulnerability in twitter secure_headers. EPSS estimates a 1.21% chance of exploitation in the next 30 days, higher than 68.4% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 4.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 23-01-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA4.4MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.21%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
Increase +0.13 pp
From 1.08% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundSecure Headers
Maturity: poc
Weaknesses
CWE · root cause- CWE-113Improper Neutralization of CRLF Sequences in HTTP HeadersThe product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Affected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- ruby-secure-headers< 6.3.1-1
RubyGems1 product
- secure_headers≥ 6.0.0, < 6.3.0 | ≥ 5.0.0, < 5.2.0 | < 3.9.0
Twitter1 product
- secure_headers< 3.9.0 | ≥ 5.0.0, < 5.2.0 | ≥ 6.0.0, < 6.3.0
Ubuntu1 product
- ruby-secure-headersAll versions (No fix recorded)
4 vendors · 4 products
References
8 links- github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwgX Refsource CONFIRMREPORTWEBExploitMitigationThird Party Advisory
- github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0X Refsource MISCREPORTWEBPatch
