RubyGems Doorkeeper CVE-2014-8144 Cross Site Request Forgery Vulnerability
BID:71831
Info
RubyGems Doorkeeper CVE-2014-8144 Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 71831 |
| Class: | Design Error |
| CVE: |
CVE-2014-8144 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 17 2014 12:00AM |
| Updated: | Dec 17 2014 12:00AM |
| Credit: | Sergey Belov of DigitalOcean |
| Vulnerable: |
Doorkeeper-gem Doorkeeper 1.4 Doorkeeper-gem Doorkeeper 0.1 |
| Not Vulnerable: |
Doorkeeper-gem Doorkeeper 2.0 Doorkeeper-gem Doorkeeper 1.4.1 |
Discussion
RubyGems Doorkeeper CVE-2014-8144 Cross Site Request Forgery Vulnerability
Doorkeeper is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user. This may aid in other attacks.
Doorkeeper 1.4.0 and prior are vulnerable.
Doorkeeper is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user. This may aid in other attacks.
Doorkeeper 1.4.0 and prior are vulnerable.
Exploit / POC
RubyGems Doorkeeper CVE-2014-8144 Cross Site Request Forgery Vulnerability
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.