CVE-2008-7248: Input Validation
A possibility to circumvent protection against cross-site request forgery (CSRF) attacks was found in Ruby on Rails. Quoting upstream security advisory for exact details:
There is a bug in all 2.1.x versions of Ruby on Rails which affects the effectiveness of the CSRF protection given by protectfromforgery.
By design rails does not perform token verification on requests with certain content types not typically generated by browsers. Unfortunately this list also included ‘text/plain’ which can be generated by browsers.
Requests can be crafted which will circumvent the CSRF protection entirely. Rails does not parse the parameters provided with these requests, but that may not be enough to protect your application.
References: ----------- http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
Upstream patch: --------------- http://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a
CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/11/28/1
Other sources
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-7248?
CVE-2008-7248 is considered to be a medium severity vulnerability due to its potential to allow cross-site request forgery attacks.
How do I fix CVE-2008-7248?
To fix CVE-2008-7248, upgrade to Ruby on Rails versions 2.1.3 or 2.2.2 or higher.
Which versions of Ruby on Rails are affected by CVE-2008-7248?
Versions 2.1.0, 2.1.1, 2.1.2, 2.2.0, and 2.2.1 of Ruby on Rails are affected by CVE-2008-7248.
What type of attacks can CVE-2008-7248 potentially allow?
CVE-2008-7248 can potentially allow attackers to exploit cross-site request forgery (CSRF) vulnerabilities.
Is CVE-2008-7248 associated with any specific software packages?
Yes, CVE-2008-7248 is specifically associated with the Ruby on Rails framework, particularly the actionpack package.