CSRF Token Fixation Affecting devise package, versions >=2.3, <3.0.1 <2.2.5
Snyk CVSS
Attack Complexity
High
User Interaction
Required
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-DEVISE-20103
- published 1 Aug 2013
- disclosed 1 Aug 2013
- credit Egor Homakov
Overview
devise is an authentication framework for Rails with Warden.
Affected versions contain a flaw that allows a remote, user-assisted attacker to conduct a CSRF token fixation attack. This issue is triggered as previous CSRF tokens are not properly invalidated when a new token is created. If an attacker has knowledge of said token, a specially crafted request can be made to it, allowing the attacker to conduct CSRF attacks.