Bug 1843152 (CVE-2020-8166) - CVE-2020-8166 rubygem-actionpack: ability to forge per-form CSRF tokens given a global CSRF token
Summary: CVE-2020-8166 rubygem-actionpack: ability to forge per-form CSRF tokens given...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-8166
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1842995 1842996 1843153 1846377
Blocks: 1843154
TreeView+ depends on / blocked
 
Reported: 2020-06-02 17:44 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-12-14 18:47 UTC (History)
28 users (show)

Fixed In Version: rubygem-actionpack-5.2.4.3, rubygem-actionpack-6.0.3.1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in rubygem-actionpack. Forgery of a per-form CSRF token is possible allowing for any action to take place for that session. The highest threat from this vulnerability is to data integrity.
Clone Of:
Environment:
Last Closed: 2021-11-08 18:01:44 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-06-02 17:44:43 UTC 
It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.

Reference:
https://groups.google.com/forum/#!msg/rubyonrails-security/NOjKiGeXUgw/XD3_jtvAAQAJ
Comment 1 Guilherme de Almeida Suckevicz 2020-06-02 17:45:02 UTC 
Created rubygem-actionpack tracking bugs for this issue:

Affects: fedora-all [bug 1843153]
Comment 3 Yadnyawalk Tale 2020-06-03 17:56:49 UTC 
GitHub Commit: https://github.com/rails/rails/commit/d124f19287f4892c72ca54da728a781591c6fca1
Note You need to log in before you can comment on or make changes to this bug.