MEDIUM
GHSA-24fg-p96v-hxh8
actionpack Cross-Site Request Forgery vulnerability
Quick fix
GHSA-24fg-p96v-hxh8 — actionpack: upgrade to the fixed version with the command below.
bundle update actionpackDetails
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-0447[ADVISORY]
- https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034[WEB]
- https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06[WEB]
- https://github.com/rails/rails[PACKAGE]
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml[WEB]
- https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291[WEB]
- https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060[WEB]
- http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain[WEB]
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html[WEB]
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html[WEB]
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html[WEB]
- http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails[WEB]
- http://www.debian.org/security/2011/dsa-2247[WEB]