QID 153014

Date Published: 2023-07-27

QID 153014: Ruby on Rails - Insufficient Authenticity Token Validation

Affected application does not adequately validate the "authenticity_token" present in POST request. Application accepts the requests with modified token or even without it.

Authenticity tokens (also known as CSRF tokens) are used to protect against CSRF attacks. These attacks work by tricking a user's browser into making unintended requests to a website, often using the user's existing session information. When a web application lacks proper authenticity token validation, it may allow unauthorized requests to be processed, posing a risk to user data and system security.

Successful exploitation of this vulnerability could result to potential security risks, such as Cross-Site Request Forgery (CSRF) attacks.

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

To prevent this vulnerability, web applications should properly implement authenticity token validation when processing form submissions or sensitive actions. This involves generating unique tokens for each user session and verifying that the submitted token matches the one associated with the user's current session. If the token is missing or invalid, the server should reject the request.

Vendor References

CVEs related to QID 153014

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].