Re: CSRF Protection Bypass in Ruby on Rails - I don''t get it ...

Xavier Noria
Wed, 09 Feb 2011 14:51:08 -0000

On Wed, Feb 9, 2011 at 3:11 PM, Michael Pavling
<pavling-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:

> On 9 February 2011 10:47, siebert
<siebertlubbe-gM/Ye1E23mwN+BqQ9rBEUg@public.gmane.org> wrote:
>> Hi all,
>>
>> My team and I are finding ourselves a little in the dark about the
>> "CSRF Protection Bypass in Ruby on Rails" vulnerability that
was
>> announced yesterday -
http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
>>
>> What am I missing?
>
> +1
>
> I was looking at this last night and shaking my head trying to work
> out whether (from the description) this affects any of my sites, and
> if so, what to do to patch it.
>
> Fortunately, I have a penetration test scheduled in a couple of weeks
> for the app I''m working on at the moment, so I''ll let
those guys tell
> me if I''m at risk, and see if they can decipher the fix...

May I suggest posting these questions to the rubyonrails-core ML?