Ability to forge per-form CSRF tokens in Rails
Moderate severity
GitHub Reviewed
Published
May 26, 2020
to the GitHub Advisory Database
•
Updated Aug 17, 2023
Package
Affected versions
>= 5.0.0, <= 5.2.4.2
>= 6.0.0, <= 6.0.3
Patched versions
5.2.4.3
6.0.3.1
Description
Reviewed
May 26, 2020
Published to the GitHub Advisory Database
May 26, 2020
Last updated
Aug 17, 2023
It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.
Impact
Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session.
Workarounds
This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
References