The PgHero gem through 2.6.0 for Ruby allows CSRF. PgHero normally uses the protect_from_forgery method from Rails to prevent CSRF. However, this defaults to :null_session, which has no effect on non-session based authentication methods. Thus the ruby gem is vulnerable with non-session based authentication methods like basic authentication.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-16253
• ankane/pghero#330
• ankane/pghero@14b67b3
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pghero/CVE-2020-16253.yml