-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a Cross-Site Request Forgery (CSRF) issue in React Router's server-side action processing. This occurs when the server does not validate if a POST request originates from a trusted source. An attacker could craft a malicious form on a different website that, when submitted by a logged-in user, would execute an action on the vulnerable application with the user's privileges.
The patch addresses this by introducing a new function, throwIfPotentialCSRFAttack, which is added in packages/react-router/lib/actions.ts. This function compares the Origin header of the request with the application's own host (derived from the Host or X-Forwarded-Host header). If they don't match, and the origin is not on an explicit allowlist (allowedActionOrigins), the request is rejected, thus preventing the CSRF attack.
This check is strategically placed in the primary functions responsible for handling server-side POST requests that can trigger actions:
handleDocumentRequest in packages/react-router/lib/server-runtime/server.ts for general server-rendered document submissions.generateRenderResponse in packages/react-router/lib/rsc/server.rsc.ts for submissions involving React Server Components.singleFetchAction in packages/react-router/lib/server-runtime/single-fetch.ts for a specific action-handling mechanism.These three functions are the entry points for the vulnerable operations, and their modification to include the throwIfPotentialCSRFAttack check is the direct mitigation for the vulnerability. Therefore, these are the functions that would be active on the stack when a CSRF exploit is attempted.
handleDocumentRequestpackages/react-router/lib/server-runtime/server.ts
generateRenderResponsepackages/react-router/lib/rsc/server.rsc.ts
singleFetchActionpackages/react-router/lib/server-runtime/single-fetch.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-router | npm | >= 7.0.0, <= 7.11.0 | 7.12.0 |
| @remix-run/server-runtime | npm | <= 2.17.2 | 2.17.3 |
A Semantic Attack on Google Gemini - Read the Latest Research