{"schema_version":"1.9.0","id":"GHSA-xq5j-gw7f-jgj8","published":"2020-07-07T16:34:10Z","modified":"2024-02-16T08:01:22.399037Z","aliases":["CVE-2020-8167"],"summary":"CSRF Vulnerability in rails-ujs","details":"There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.\n\nVersions Affected:  rails <= 6.0.3\nNot affected:       Applications which don't use rails-ujs.\nFixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1\n\nImpact\n------\n\nThis is a regression of CVE-2015-1840.\n\nIn the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.\n\nWorkarounds\n-----------\n\nTo work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.\n\nFor example, code like this:\n\n    link_to params\n\nto code like this:\n\n    link_to filtered_params\n\n    def filtered_params\n      # Filter just the parameters that you trust\n    end","affected":[{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.2.4.3"}]}],"versions":["5.0.0","5.0.0.1","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.rc1"],"database_specific":{"last_known_affected_version_range":"<= 5.2.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-xq5j-gw7f-jgj8/GHSA-xq5j-gw7f-jgj8.json"}},{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3.1"}]}],"versions":["6.0.0","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.rc1"],"database_specific":{"last_known_affected_version_range":"<= 6.0.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-xq5j-gw7f-jgj8/GHSA-xq5j-gw7f-jgj8.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8167"},{"type":"WEB","url":"https://hackerone.com/reports/189878"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-8167.yml"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0"},{"type":"WEB","url":"https://groups.google.com/g/rubyonrails-security/c/x9DixQDG9a0"},{"type":"WEB","url":"https://www.debian.org/security/2020/dsa-4766"}],"database_specific":{"cwe_ids":["CWE-352"],"github_reviewed":true,"github_reviewed_at":"2020-07-07T15:51:37Z","nvd_published_at":"2020-06-19T18:15:00Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}