CVE-2020-12480: CSRF in Play Framework
Summary
CVE-2020-12480: CSRF in Play Framework. Affects com.typesafe.play:play_2.12 across 2 version ranges.
< 2.7.5
>= 2.8.0, < 2.8.2
Fixed in 2.7.5 or 2.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Play Framework is a web application framework written in Scala and Java that follows the model-view-controller architectural pattern. It provides a set of APIs and tools for building web applications. The affected package, com.typesafe.play:play_2.12, is a specific version of the Play Framework designed for Scala 2.12. This vulnerability affects versions 2.6.0 through 2.8.1 of the Play Framework.
Vulnerability Detail
The CSRF (Cross-Site Request Forgery) filter in Play Framework versions 2.6.0 through 2.8.1 can be bypassed by making CORS (Cross-Origin Resource Sharing) simple requests with content types that contain parameters that can't be parsed. This vulnerability allows an attacker to forge requests on behalf of authenticated users, potentially leading to unauthorized actions being performed on the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.52.7.5 -
>= 2.8.0, < 2.8.22.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version of the Play Framework as soon as possible.
Conclusion
In conclusion, the CSRF vulnerability in Play Framework versions 2.6.0 through 2.8.1 can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed. It is crucial to upgrade to a fixed version of the Play Framework to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.typesafe.play:play_2.12 →
FAQ
The Play Framework is a web application framework written in Scala and Java that follows the model-view-controller architectural pattern. It provides a set of APIs and tools for building web applications.
CSRF (Cross-Site Request Forgery) is an attack that tricks the victim into submitting a malicious request. In the context of web applications, it involves exploiting the trust that a site has in a user's browser.
CORS (Cross-Origin Resource Sharing) is a mechanism that allows many resources (e.g., fonts, JavaScript, etc.) on a web page to be requested from another domain outside the domain from which the resource originated.
This vulnerability allows an attacker to forge requests on behalf of authenticated users, potentially leading to unauthorized actions being performed on the application. This can result in data breaches, unauthorized access, and other security issues.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.typesafe.play:play_2.12.
