PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Mitigating CWE-352: Cross-Site Request Forgery in Ruby Applications

hackerone.com | vulnerability | #ruby | #web-security | #csrf | #rails | #cwe-352
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A guide to CSRF (CWE-352) in Ruby apps: verify Rails authenticity tokens, keep side effects off GET requests, and audit skip_before_action bypasses, then fix with proper token validation.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Introducing the RubySec Field Guide
Trail of Bits releases the RubySec Field Guide, a training resource on YAML deserialization flaws, Rails vulnerability root causes, Rack rootkit techniques, and defensive Ruby programming practices.
vulnerability · hackerone.com
How To: Command Injections
Command injection tutorial: setup with two Ruby test scripts, sleep-based timing to detect first-order injection, how it differs from RCE, plus notes on defeating mitigations and common caveats.
vulnerability · hackerone.com
How To: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) tutorial: using a vulnerable Ruby/Sinatra app, it covers the impact, how to test for SSRF, pivots into internal networks, defeating mitigations and caveats.
vulnerability · portswigger.net
On-site request forgery
Stored on-site request forgery works even where XSS is blocked: controlling part of an image URL forces arbitrary on-site GET requests, e.g. creating a backdoor when an admin views the page.
vulnerability · portswigger.net
Exploiting XSS in POST requests
Reflected XSS reachable only via POST is exploitable: an attacker page auto-submits a crafted form cross-domain, CSRF-style, and the payload runs inside the vulnerable application's security context.
vulnerability · bishopfox.com
Ruby Vulnerabilities: Exploiting Dangerous Open, Send and Deserialization Operations
A walkthrough of three common Ruby-specific remote code execution bugs exploiting dangerous open, send, and deserialization operations in a Ruby on Rails application, with exploit examples.
Back