CVE-2020-16252

The Field Test gem, versions 0.2.0 through 0.3.2, contains a cross-site request forgery (CSRF) vulnerability [1][4]. The gem provides A/B testing for Rails applications and includes a dashboard for viewing results and updating variants. The root cause is that the gem uses Rails' protect_from_forgery method, which defaults to the :null_session strategy. This strategy has no effect when non-session based authentication methods, such as basic authentication, are used, leaving the dashboard unprotected against CSRF [4].

To exploit this vulnerability, an attacker must trick an authenticated user into visiting a malicious website. The attacker can then forge requests on behalf of that user. Only a single endpoint is affected, which allows changing the variant assigned to a user [4]. Session-based authentication methods, like Devise's default, are not affected [4].

Successful exploitation enables an attacker to change the variant assigned to a victim user, potentially skewing A/B test results or manipulating the user experience [4].

The vulnerability has been addressed in Field Test version 0.4.0, where the CSRF protection strategy was changed to protect_from_forgery with: :exception [4]. All users running an affected release are advised to upgrade immediately (0.4.0) [4].