VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 16, 2009· Updated Apr 23, 2026

CVE-2008-7248

CVE-2008-7248

Description

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
actionpackRubyGems
>= 2.1.0, < 2.1.32.1.3
actionpackRubyGems
>= 2.2.0, < 2.2.22.2.2

Affected products

5
  • Rubyonrails/Rails5 versions
    cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:*

Patches

1
099a98e9b710

Verify form submissions for text/plain posts too.

https://github.com/rails/railsMichael KoziarskiNov 16, 2008via ghsa
commit
1 file changed · +1 −1
  • actionpack/lib/action_controller/mime_type.rb+1 −1 modified
    @@ -18,7 +18,7 @@ module Mime
   #   end
   class Type
     @@html_types = Set.new [:html, :all]
-    @@unverifiable_types = Set.new [:text, :json, :csv, :xml, :rss, :atom, :yaml]
+    @@unverifiable_types = Set.new [:json, :csv, :xml, :rss, :atom, :yaml]
     cattr_reader :html_types, :unverifiable_types
 
     # A simple helper class used in parsing the accept header

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

25

News mentions

0

No linked articles in our index yet.