Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-16252

CVE-2020-16252:
Field Test CSRF vulnerability

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-16252
GHSA ID
GHSA-w542-cpp9-r3g7
EPSS Score
0.32978%
CWE
CWE-352
Published
8/5/2020
Updated
7/5/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
field_testrubygems>= 0.2.0, <= 0.3.20.4.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from Rails' protect_from_forgery defaulting to :null_session, which only clears the session when CSRF validation fails. Since non-session authentication methods (like HTTP Basic Auth) don't rely on session cookies, this strategy fails to protect them. The fix explicitly sets with: :exception to enforce CSRF token validation regardless of authentication method. The affected code is directly shown in the commit diff modifying BaseController.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** *i*l* T*st **s**o*r* is vuln*r**l* to *ross-sit* r*qu*st *or**ry (*SR*) wit* non-s*ssion **s** *ut**nti**tion m*t*o*s in v*rsions v*.*.* t*rou** v*.*.*. ## Imp**t T** *i*l* T*st **s**o*r* is vuln*r**l* to *SR* wit* non-s*ssion **s** *ut**nti**ti

Reasoning

T** vuln*r**ility st*ms *rom R*ils' `prot**t_*rom_*or**ry` ****ultin* to `:null_s*ssion`, w*i** only *l**rs t** s*ssion w**n *SR* v*li**tion **ils. Sin** non-s*ssion *ut**nti**tion m*t*o*s (lik* *TTP **si* *ut*) *on't r*ly on s*ssion *ooki*s, t*is st