CVE-2020-5217: Directive injection when using dynamic overrides with user input in RubyGems secure_headers
Vulnerability summary
CVE-2020-5217 is a medium (CVSS 5.8) vulnerability in twitter secure_headers. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.8% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 4.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 23-01-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA4.4MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.83%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.83% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundSecure Headers
Maturity: poc
Weaknesses
CWE · root cause- CWE-95Improper Neutralization of Directives in Dynamically Evaluated CodeThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Affected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- ruby-secure-headers< 6.3.1-1
RubyGems1 product
- secure_headers≥ 6.0.0, < 6.2.0 | ≥ 5.0.0, < 5.1.0 | < 3.8.0
Twitter1 product
- secure_headers< 3.8.0 | ≥ 5.0.0, < 5.1.0 | ≥ 6.0.0, < 6.2.0
Ubuntu1 product
- ruby-secure-headersAll versions (No fix recorded)
4 vendors · 4 products
References
10 links- github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397cX Refsource CONFIRMREPORTWEBMitigationThird Party Advisory
- github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3X Refsource MISCREPORTWEBPatch
