Executive brief
jquery-ujs is a JavaScript library used in Ruby on Rails applications to enhance form handling and link functionality. A vulnerability in versions 1.0.3 and earlier allows attackers to trick the library into sending CSRF tokens (security tokens that prevent unauthorized actions) to attacker-controlled external websites. This could enable attackers to forge requests on behalf of legitimate users, potentially leading to unauthorized actions like account changes, data modification, or fraudulent transactions.
Technical details
This is a CSRF token leakage vulnerability (CWE-352) in jquery-ujs that stems from improper same-origin validation. When an attacker controls an href attribute of an anchor tag or action attribute of a form tag, they can prepend a space before an external domain URL. jQuery's URL parsing incorrectly treats the space-prepended URL as a same-origin request, causing the library to include the user's CSRF token in the request to the attacker's domain. The attack requires no authentication or user interaction beyond visiting a malicious page with crafted links or forms. An attacker can capture valid CSRF tokens and use them to perform unauthorized actions. The fix was released in version 1.0.4.
Affected products
- jquery jquery-ujs 1.0.3 and earlier
Timeline
- 2020-08-31: disclosed
- 2020-08-31: patched: Fixed in version 1.0.4