CVE-2024-47888

What it actually does

This is a regular-expression denial-of-service issue in Rails Action Text. In affected Rails versions 6.0.0 through 6.1.7.8, 7.0.0 through 7.0.8.4, 7.1.0 through 7.1.4.0, and 7.2.0 through 7.2.1.0, carefully crafted rich text can cause the Action Text `plain_text_for_blockquote_node` helper to spend excessive CPU time while processing blockquote content. The flaw impacts availability rather than confidentiality or integrity: an attacker can make application workers slow, hang, or exhaust request-processing capacity when vulnerable code paths convert attacker-controlled Action Text content to plain text. Applications running Ruby 3.2 or newer are described as unaffected because Ruby 3.2 includes mitigations relevant to this behavior.

Why it matters to the business

Successful exploitation can make Rails applications slow or unavailable, especially where public or low-trust users can submit rich text that is later rendered, previewed, indexed, emailed, searched, or otherwise converted to plain text. The risk is primarily service disruption: elevated CPU use, saturated web workers, request timeouts, queue backlogs, degraded user experience, and potential autoscaling or infrastructure cost increases. The issue is not currently in CISA KEV, is not reported as ransomware-associated, and has low EPSS, but it is remotely triggerable without authentication where exposed rich-text workflows exist, so internet-facing applications should still be patched during normal vulnerability remediation cycles.

How an attack unfolds

An attacker identifies a Rails application that uses Action Text and accepts rich text input, such as comments, posts, messages, descriptions, support tickets, or profile fields. The attacker submits content containing specially structured blockquote text intended to trigger inefficient regular-expression behavior when Action Text converts the document to plain text using `plain_text_for_blockquote_node`. The malicious content may be processed immediately during validation, preview, rendering, notification generation, search indexing, background jobs, or later when another user or system views the content. Each processing event consumes abnormal CPU time and ties up an application worker. Repeated submissions or repeated requests to process the stored content can degrade application performance or cause denial of service.

How to fix it

Upgrade Rails to a fixed version: 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1, or later. If tracking Rails from source, ensure the fix corresponding to commit `b2fbbfbcaa3d662c68a9ee21ab6cf95eccc2b4ec` is present. If immediate Rails upgrade is not possible, apply the relevant upstream patch for the deployed Rails branch. As a workaround, avoid calling `plain_text_for_blockquote_node` on attacker-controlled or untrusted content, disable affected plain-text conversion workflows where practical, or run the application on Ruby 3.2 or newer, which includes mitigations for this issue. Add request size limits, rich-text input length limits, request timeouts, worker timeouts, rate limiting, and background-job retry controls to reduce denial-of-service impact. Rails 8.0.0.beta1 and later Ruby 3.2+-only configurations are not expected to be affected by this specific issue.

How to confirm the fix worked

Confirm deployed Rails and Action Text versions using dependency manifests and runtime checks, such as `Gemfile.lock`, `bundle info rails`, and `Rails.version`. Verify the application is on Rails 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1, or later, or that the upstream patch commit is included. Confirm the runtime Ruby version is 3.2 or newer if relying on the Ruby-level mitigation. Search the codebase for calls to `plain_text_for_blockquote_node` and workflows that call `to_plain_text` or otherwise convert Action Text content to plain text. In staging, test representative rich-text blockquote content and verify processing completes within expected time and does not cause excessive CPU consumption or request timeouts. Confirm request timeouts, worker recycling, rate limits, and input-size limits are active for endpoints accepting rich text.

Typical attack path

1. Find an application endpoint that accepts or stores Rails Action Text rich text content.
2. Submit crafted rich text containing blockquote structures designed to trigger excessive processing in `plain_text_for_blockquote_node`.
3. Trigger a code path that converts the Action Text content to plain text, such as preview, rendering, email generation, indexing, export, or background processing.
4. Repeat requests or store multiple malicious rich-text records to increase CPU consumption and worker saturation.
5. Cause slow responses, request timeouts, background job delays, or partial application unavailability.

How to detect it

Look for evidence of denial-of-service behavior around rich-text submission and processing. Useful sources include Rails production logs, web server and reverse proxy access logs, application performance monitoring traces, background job logs, container or host CPU metrics, WAF logs, and exception/timeout logs. Hunt for bursts of slow requests, 5xx responses, 499/504 gateway timeouts, worker restarts, request timeout exceptions, and CPU saturation correlated with endpoints that create, update, preview, render, email, index, or export Action Text content. Inspect request bodies or stored rich text, where logging and privacy controls allow, for unusually large or deeply repeated `<blockquote>` structures. In application traces, focus on time spent in Action Text plain-text conversion, especially calls involving `plain_text_for_blockquote_node`, `to_plain_text`, or `ActionText::Content`. Because there are no public attacker-specific indicators, detection should be behavior-based: repeated rich-text submissions followed by high CPU, long request duration, and timeout errors are the strongest signals.

• plain_text_for_blockquote_node
• ActionText::Content
• to_plain_text
• <blockquote
• </blockquote>
• Rack::Timeout::RequestTimeoutException
• Rack::Timeout
• Timeout::Error
• Net::ReadTimeout
• ActionView::Template::Error
• ActiveJob::DeserializationError
• Worker timeout
• request timeout
• execution expired
• status=504
• HTTP 504
• status=500
• ActionText::RichText
• action_text_rich_texts

What your security team should do

• Inventory Rails applications using Action Text, especially internet-facing workflows that accept rich text from unauthenticated or low-trust users.
• Prioritize upgrades to Rails 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1, or later for exposed applications.
• Confirm Ruby runtime versions; applications on Ruby 3.2 or newer are mitigated for this issue, but Rails should still be kept current.
• Apply temporary controls where patching is delayed: rate limiting, maximum rich-text length, request/body size limits, request timeouts, and background job execution time limits.
• Review logs and metrics for historical signs of exploitation, including CPU spikes, slow requests, request timeouts, and repeated submissions containing blockquote-rich content.
• Add monitoring for abnormal processing time in Action Text rendering, preview, notification, indexing, and background-job paths.
• Ensure dependency scanners do not misclassify unrelated package data; this vulnerability is specifically associated with Rails Action Text behavior.