Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Mitigating CWE-352: Cross-Site Request Forgery in Ruby Applications

hackerone.com | vulnerability | #ruby | #web-security | #csrf | #rails | #cwe-352

Summary

A guide to CSRF (CWE-352) in Ruby apps: verify Rails authenticity tokens, keep side effects off GET requests, and audit skip_before_action bypasses, then fix with proper token validation.
Published
Collected

original ↗

Related coverage

  1. Introducing the RubySec Field Guide (blog.trailofbits.com)
  2. How To: Command Injections (hackerone.com)
  3. How To: Server-Side Request Forgery (SSRF) (hackerone.com)
  4. On-site request forgery (portswigger.net)
  5. Exploiting XSS in POST requests (portswigger.net)
  6. Ruby Vulnerabilities: Exploiting Dangerous Open, Send and Deserialization Operations (bishopfox.com)

back