Every CVE Search/ Get API key

CVE-2024-29034

CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained

6.8 MediumFix available

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by content_type_allowlist, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.44%Up 0.4 points since Mar 25, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.8

CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by content_type_allowlist, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.

Record
CVE-2024-29034
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-436, CWE-79
Updated
2026-11-02
EUVDEUVD-2024-1016 6.8

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by content_type_allowlist, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.

Record
EUVD-2024-1016
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-vfmv-jfc5-pjjw 6.8

CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Impact

The vulnerability CVE-2023-49090 wasn't fully addressed.

This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by content_type_allowlist, by providing multiple values separated by commas.

This bypassed value can be used to cause XSS.

Patches

Upgrade to 3.0.7 or 2.2.6.

Workarounds

Use the following monkey patch to let CarrierWave parse the Content-type by using Marcel::MimeType.for.

# For CarrierWave 3.x
CarrierWave::SanitizedFile.class_eval do
  def declared_content_type
    @declared_content_type ||
      if @file.respond_to?(:content_type) && @file.content_type
        Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)
      end
  end
end

# For CarrierWave 2.x
CarrierWave::SanitizedFile.class_eval do
  def existing_content_type
    if @file.respond_to?(:content_type) && @file.content_type
      Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)
    end
  end
end

References

OWASP - File Upload Cheat Sheet

Record
GHSA-vfmv-jfc5-pjjw
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-79, CWE-436
Updated
2026-11-02
NVD 6.8

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by content_type_allowlist, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.

Record
CVE-2024-29034
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79, CWE-436
Updated
2026-11-02
OSV 6.8

CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by content_type_allowlist, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.

Record
CVE-2024-29034
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-436, CWE-79
Updated
2026-11-02
OSVGHSA-vfmv-jfc5-pjjw 6.8

CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Impact

The vulnerability CVE-2023-49090 wasn't fully addressed.

This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by content_type_allowlist, by providing multiple values separated by commas.

This bypassed value can be used to cause XSS.

Patches

Upgrade to 3.0.7 or 2.2.6.

Workarounds

Use the following monkey patch to let CarrierWave parse the Content-type by using Marcel::MimeType.for.

# For CarrierWave 3.x
CarrierWave::SanitizedFile.class_eval do
  def declared_content_type
    @declared_content_type ||
      if @file.respond_to?(:content_type) && @file.content_type
        Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)
      end
  end
end

# For CarrierWave 2.x
CarrierWave::SanitizedFile.class_eval do
  def existing_content_type
    if @file.respond_to?(:content_type) && @file.content_type
      Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)
    end
  end
end

References

OWASP - File Upload Cheat Sheet

Record
GHSA-vfmv-jfc5-pjjw
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-436, CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
carrierwave
RubyGems
 3.0.0 up to 3.0.7
3.0.7
carrierwave
RubyGems
 before 2.2.6
2.2.6
carrierwave
RubyGems
 3.0.0 up to 3.0.7, plus listed versions
3.0.13.0.23.0.33.0.43.0.53.0.6
3.0.7
carrierwave
RubyGems
 before 2.2.6, plus listed versions
0.10.10.00.11.00.11.10.11.2
Show 45 moreShow less
0.2.00.2.10.2.30.2.40.3.00.3.10.3.20.3.30.3.40.3.50.3.5.10.3.5.20.4.00.4.10.4.100.4.20.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.0.beta20.5.10.5.20.5.30.5.40.5.50.5.60.5.70.5.80.6.00.6.10.6.20.7.00.7.10.8.00.9.01.0.01.0.0.beta1.0.0.rc1.1.01.2.0
2.2.6

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-29034 is a medium vulnerability (CVSS 6.8) in Carrierwave Project Carrierwave, published March 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in carrierwave 3.0.7.

References

This page doesn't list everything

Left out here: 20 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open