CVE-2020-8167

Vulnerability

CVE-2020-8167 is a Cross-Site Request Forgery (CSRF) vulnerability in the rails-ujs module of Ruby on Rails versions 6.0.3 and earlier. The vulnerability is a regression of CVE-2015-1840 [3]. When an attacker can control the href attribute of an anchor tag or the action attribute of a form tag that triggers a POST action, they can set the attribute to a cross-origin URL and the CSRF token will be sent to that domain [1][3].

Exploitation

Exploitation requires the attacker to be able to inject or control the href of a link or the action of a form that results in a POST request. Applications that use rails-ujs are affected; those that do not use rails-ujs are not vulnerable [3]. No authentication is needed on the attacker's part beyond the ability to place the crafted link or form on a page served by the Rails application.

Impact

An attacker can leverage this to perform cross-origin state-changing operations on behalf of an authenticated user, potentially leading to account compromise or data modification, as the Rails CSRF token is sent to the attacker-controlled domain [1][3].

Mitigation

The fixed versions are Rails 5.2.4.3 and 6.0.3.1, which correct the improper sending of CSRF tokens to cross-origin destinations [1][3]. As a workaround, developers should filter user-controlled parameters used in link_to or form tags to prevent injection of untrusted href or action values [3].