Updated advisory posts against rubysec/ruby-advisory-db@2626a46

Author: Fryguy

advisories/_posts/2024-02-28-CVE-2024-27285.md

@@ -31,22 +31,34 @@ advisory:
     JavaScript payloads through carefully crafted URLs.
 
     Snippet from "frames.erb":
+    (v0.9.34)
     ```erb
     <script type="text/javascript">
       var match = unescape(window.location.hash).match(/^#!(.+)/);
-      var name = match ? match[1] : '<= url_for_main >';
+      var name = match ? match[1] : '<%= url_for_main %>';
       name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
       window.top.location = name;
     </script>
     ```
 
+    (v0.9.35)
+    ```erb
+    <script type="text/javascript">
+      var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
+      var name = match ? match[1] : '<%= url_for_main %>';
+      name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
+      window.top.location.replace(name)
+    </script>
+    ```
+
     ### PoC (Proof of Concept)
 
     To exploit this vulnerability:
     1. Gain access to the generated Yard Doc.
     2. Locate and access the "frames.html" file.
     3. Construct a URL containing the malicious payload in the hash
-       segment, for instance: `#!javascript:xss`
+       segment, for instance: `#!javascript:xss` for v0.9.34, and
+       `#:javascript:xss` for v0.9.35
 
     ### Impact
 
@@ -60,12 +72,14 @@ advisory:
     the application's integrity.
   cvss_v3: 5.4
   patched_versions:
-  - ">= 0.9.35"
+  - ">= 0.9.36"
   related:
     url:
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27285
-    - https://github.com/lsegal/yard/releases/tag/v0.9.35
     - https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
     - https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-27285
     - https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
+    - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
+    - https://github.com/lsegal/yard/pull/1538
+    - https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
 ---