Bug 544329 (CVE-2008-7248)

Summary:	CVE-2008-7248 rubygem-actionpack: Potential CSRF protection circumvention
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	lutter, mtasaka, vanmeeuwen+fedora
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-02-03 06:42:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2009-12-04 16:12:44 UTC

A possibility to circumvent protection against cross-site request
forgery (CSRF) attacks was found in Ruby on Rails. Quoting upstream
security advisory for exact details:

There is a bug in all 2.1.x versions of Ruby on Rails which affects
the effectiveness of the CSRF protection given by protect_from_forgery.

By design rails does not perform token verification on requests with certain content types not typically generated by browsers. Unfortunately this list also included ‘text/plain’ which can be generated by browsers.

Requests can be crafted which will circumvent the CSRF protection entirely. Rails does not parse the parameters provided with these requests, but that may not be enough to protect your application.

References:
-----------
http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1

Upstream patch:
---------------
http://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a

CVE Request:
------------
http://www.openwall.com/lists/oss-security/2009/11/28/1

Comment 1 Jan Lieskovsky 2009-12-04 16:15:53 UTC

This issue affects the versions of the rubygem-actionpack package,
as shipped with Fedora release of 10, 11 and 12.

This issue affects the version of the rubygem-actionpack package,
as shipped with Extra Packages for Enterprise Linux 5 (EPEL-5) project.

Please fix.

Comment 2 Mamoru TASAKA 2009-12-05 20:05:27 UTC

For F-13/12/11 (i.e. for rubygem-actionpack 2.3.x) this is NOTABUG
because the usage of unverifiable_types is deprecated (and not used)

https://rails.lighthouseapp.com/projects/8994/tickets/1145-bug-invalidauthenticitytoken-incorrectly-raised-for-xml-controllerdestroy-request

git commit:
http://github.com/rails/rails/commit/f1ad8b48aae3ee26613b3e77bc0056e120096846

Only affects F-10 and EL-5, if any.

Comment 3 Fedora Update System 2009-12-06 18:27:36 UTC

rubygem-actionpack-2.1.1-5.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/rubygem-actionpack-2.1.1-5.fc10

Comment 4 Fedora Update System 2009-12-06 18:29:03 UTC

rubygem-actionpack-2.1.1-5.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/rubygem-actionpack-2.1.1-5.el5

Comment 5 Fedora Update System 2009-12-10 04:00:55 UTC

rubygem-actionpack-2.1.1-5.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2009-12-10 04:12:24 UTC

rubygem-actionpack-2.1.1-5.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Jan Lieskovsky 2009-12-13 17:13:56 UTC

This is CVE-2008-7248.

Comment 8 Mamoru TASAKA 2010-02-03 06:42:33 UTC

I think this can be closed.