Medium, CVSS 6.3RubyGemsPublished
Older releases of better_errors open to Cross-Site Request Forgery attack
CVE-2021-39197 · GHSA-w3j4-76qw-wwjm
- Affected
- RubyGems better_errors < 2.8.0
- Fixed in
- 2.8.0· Vendor fix available
- Issue
- Impact bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with bettererrors enabled open to cross-origin attacks. As a developer tool, bettererrors documentation strongly recommends addition only to the development bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits bettererrors to the development group (or the non-Rails equivalent). Patches Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~ 2.8.3". Workarounds There are no known workarounds to mitigate the risk of using older releases of bettererrors. References - Chris Moberly provided an example attack that uses a now-patched vulnerability of…
Recommended action: Upgrade to 2.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.