CVE-2015-1840
published 2015-07-26CVE-2015-1840: jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote…
PriorityP428medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
4.40%
90.2th percentile
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby-jquery-rails | < ruby-jquery-rails 4.0.4-1 (bookworm) | ruby-jquery-rails 4.0.4-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| rails | actionview | >= 5.0.0 < 5.2.4.3 | 5.2.4.3 |
| rails | actionview | >= 6.0.0 < 6.0.3.1 | 6.0.3.1 |
| rubyonrails | jquery-rails | <= 3.1.2 | — |
| rubyonrails | jquery-rails | — | — |
| rubyonrails | jquery-rails | — | — |
| rubyonrails | jquery-rails | >= 0 < 3.1.3 | 3.1.3 |
| rubyonrails | jquery-rails | >= 4.0.0 < 4.0.4 | 4.0.4 |
| rubyonrails | jquery-ujs | <= 1.0.3 | — |
| rubyonrails | jquery-ujs | >= 0 < 1.0.4 | 1.0.4 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
ghsa5.0MEDIUM
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rubygem-actionview: CSRF vulnerability in rails-ujs
vendor_redhat·2020-05-18·CVSS 5.0
CVE-2020-8167 [MEDIUM] CWE-352 rubygem-actionview: CSRF vulnerability in rails-ujs
rubygem-actionview: CSRF vulnerability in rails-ujs
A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.
A flaw was found in rubygem-actionview. A regression of CVE-2015-1840 causes Rails-ujs to send CSRF tokens to wrong domains. The highest threat from this vulnerability is to data integrity.
Package: cfme-amazon-smartstate (CloudForms Management Engine 5) - Not affected
Package: cfme-gemset (CloudForms Management Engine 5) - Will not fix
Red Hat
rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails
vendor_redhat·2015-06-16·CVSS 5.0
CVE-2015-1840 [MEDIUM] CWE-212 rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails
rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
A flaw was found in the way rubygem-jquery-rails filtered CSRF tokens from HTTP requests. An attacker able to control the href attribute of an anchor tag or the action attribute of a form tag, could use this flaw to force an application to send a request that includes a CSRF token to an attacker-specified site, thus leaking the CSRF token.
Package: ruby193-rubygem-jquery-rails (C
Debian
CVE-2015-1840: ruby-jquery-rails - jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in ...
vendor_debian·2015·CVSS 5.0
CVE-2015-1840 [MEDIUM] CVE-2015-1840: ruby-jquery-rails - jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in ...
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Scope: local
bookworm: resolved (fixed in 4.0.4-1)
bullseye: resolved (fixed in 4.0.4-1)
forky: resolved (fixed in 4.0.4-1)
sid: resolved (fixed in 4.0.4-1)
trixie: resolved (fixed in 4.0.4-1)
OSV
CSRF Vulnerability in rails-ujs
osv·2020-07-07·CVSS 5.0
CVE-2020-8167 [MEDIUM] CSRF Vulnerability in rails-ujs
CSRF Vulnerability in rails-ujs
There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.
Versions Affected: rails = 5.2.4.3, rails >= 6.0.3.1
Impact
This is a regression of CVE-2015-1840.
In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.
Workarounds
To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.
For example, code like this:
link_to params
to code like this:
link_to filtered_params
def filtered_params
# F
GHSA
CSRF Vulnerability in rails-ujs
ghsa·2020-07-07·CVSS 5.0
CVE-2020-8167 [MEDIUM] CWE-352 CSRF Vulnerability in rails-ujs
CSRF Vulnerability in rails-ujs
There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.
Versions Affected: rails = 5.2.4.3, rails >= 6.0.3.1
Impact
This is a regression of CVE-2015-1840.
In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.
Workarounds
To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.
For example, code like this:
link_to params
to code like this:
link_to filtered_params
def filtered_params
# F
OSV
jquery-rails and jquery-ujs subject to Exposure of Sensitive Information
osv·2017-10-24
CVE-2015-1840 [MEDIUM] jquery-rails and jquery-ujs subject to Exposure of Sensitive Information
jquery-rails and jquery-ujs subject to Exposure of Sensitive Information
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
GHSA
jquery-rails and jquery-ujs subject to Exposure of Sensitive Information
ghsa·2017-10-24
CVE-2015-1840 [MEDIUM] CWE-200 jquery-rails and jquery-ujs subject to Exposure of Sensitive Information
jquery-rails and jquery-ujs subject to Exposure of Sensitive Information
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
OSV
CVE-2015-1840: jquery_ujs
osv·2015-07-26·CVSS 5.0
CVE-2015-1840 [MEDIUM] CVE-2015-1840: jquery_ujs
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-8167 rubygem-actionview: CSRF vulnerability in rails-ujs
bugzilla·2020-06-02·CVSS 5.0
CVE-2020-8167 [MEDIUM] CVE-2020-8167 rubygem-actionview: CSRF vulnerability in rails-ujs
CVE-2020-8167 rubygem-actionview: CSRF vulnerability in rails-ujs
There is an vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains. This is a regression of CVE-2015-1840.
Reference:
https://groups.google.com/forum/#!msg/rubyonrails-security/x9DixQDG9a0/1kX1XubAAQAJ
Discussion:
Created rubygem-actionview tracking bugs for this issue:
Affects: fedora-all [bug 1843085]
---
External References:
https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0
---
GitHub Commit: https://github.com/rails/rails/commit/a20fbf9bc52e9596a675c1071ab3fe052ac4f0dc
HackerOne
CSRF header is sent to external websites when using data-remote forms
hackerone·2020-05-26·CVSS 5.0
CVE-2015-1840 [MEDIUM] CSRF header is sent to external websites when using data-remote forms
CSRF header is sent to external websites when using data-remote forms
Looks like there is a regression in the fix for CVE-2015-1840 ([H1 report](https://hackerone.com/reports/49935)). The origin isn't being checked before adding a CSRF header to `data-remote` forms. I noticed this when checking out the new rails-ujs repo.
Example Rails template:
```
submit
```
Example http://attacker.com app
```
require "sinatra"
options '/*' do
headers['Access-Control-Allow-Origin'] = "*"
headers['Access-Control-Allow-Methods'] = "POST"
headers['Access-Control-Allow-Headers'] ="x-csrf-token"
end
post '/*' do
"foo"
end
```
When the form is submitted, an XHR request to attacker.com is sent, including the `X-CSRF-Token` header.
PS: @tenderlove told me to submit this here. I shouldn't get paid sinc
Bugzilla
CVE-2015-1840 rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails
bugzilla·2015-06-18·CVSS 5.0
CVE-2015-1840 [MEDIUM] CVE-2015-1840 rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails
CVE-2015-1840 rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails
There's an vulnerability in jquery-ujs and jquery-rails that can be used to bypass CSP protections and allows attackers to send CSRF tokens to attacker domains.
In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to " https://attacker.com" (note the leading space) that will be passed to JQuery, who will see this as a same origin request, and send the user's CSRF token to the attacker domain.
Workarounds
To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to fil
Bugzilla
CVE-2015-1840 rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails [fedora-all]
bugzilla·2015-06-18·CVSS 5.0
CVE-2015-1840 [MEDIUM] CVE-2015-1840 rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails [fedora-all]
CVE-2015-1840 rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
HackerOne
rails-ujs will send CSRF tokens to other origins
hackerone·2015-06-16
rails-ujs will send CSRF tokens to other origins
rails-ujs will send CSRF tokens to other origins
I reported this via email a few months ago. Here was my initial email:
> Hello,
> I've been playing with getting Rails apps to send CSRF tokens to the wrong domains and I found a few problems. The main motivation for this is in attacking a site that uses Content Security Policy. With CSP enabled, an attacker with an XSS vulnerability cannot simply inject inline JavaScript, but they can still abuse some Rails features to steal a CSRF token.
>
> In the scenario where an attacker can inject arbitrary HTML into the response, the simplest attack would be to inject:
>
>
>
> Clicking on this link will trigger an OPTIONS request to attacker.com. If the attacker returns the correct CORS headers, a POST request containing the user's CSRF token will
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160906.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.htmlhttp://lists.opensuse.org/opensuse-updates/2015-07/msg00041.htmlhttp://openwall.com/lists/oss-security/2015/06/16/15http://www.securityfocus.com/bid/75239https://github.com/rails/jquery-rails/blob/master/CHANGELOG.mdhttps://github.com/rails/jquery-ujs/blob/master/CHANGELOG.mdhttps://groups.google.com/forum/message/raw?msg=rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4Jhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/160906.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.htmlhttp://lists.opensuse.org/opensuse-updates/2015-07/msg00041.htmlhttp://openwall.com/lists/oss-security/2015/06/16/15http://www.securityfocus.com/bid/75239https://github.com/rails/jquery-rails/blob/master/CHANGELOG.mdhttps://github.com/rails/jquery-ujs/blob/master/CHANGELOG.mdhttps://groups.google.com/forum/message/raw?msg=rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J
2015-07-26
Published