CVE-2020-8167: CSRF Vulnerability in rails-ujs
Summary
CVE-2020-8167: CSRF Vulnerability in rails-ujs. Affects actionview across 2 version ranges.
>= 5.0.0, < 5.2.4.3
>= 6.0.0, < 6.0.3.1
Fixed in 5.2.4.3 or 6.0.3.1, depending on the release line you run. How to fix ↓
Also tracked for
- rails · Debian:11
The same CVE-2020-8167 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rails-ujs package is a JavaScript library that provides unobtrusive scripting support for Ruby on Rails applications. It is responsible for handling AJAX requests, form submissions, and other client-side interactions. This vulnerability affects versions of rails-ujs up to 6.0.3. It allows attackers to send CSRF tokens to wrong domains, potentially leading to unauthorized actions being performed on behalf of users.
Vulnerability Detail
The vulnerability is a regression of CVE-2015-1840. In certain scenarios where an attacker can control the href attribute of an anchor tag or the action attribute of a form tag that triggers a POST action, they can set the href or action to a cross-origin URL. This causes the CSRF token to be sent to the wrong domain, enabling the attacker to perform unauthorized actions on behalf of the user. The impact of this vulnerability can range from unauthorized data modifications to potential account takeovers.
How To Fix
Latest published version: 8.1.4 as of 23 Oct 2026
gem install actionview -v 8.1.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.0.0, < 5.2.4.35.2.4.3gem install actionview -v 5.2.4.3 -
>= 6.0.0, < 6.0.3.16.0.3.1gem install actionview -v 6.0.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for this vulnerability is to filter the user parameters that control the href attribute of anchor tags or the action attribute of form tags. By implementing a function that filters only the trusted parameters, the risk of sending the CSRF token to wrong domains can be reduced. For example, instead of using link_to params, the code can be modified to use link_to filtered_params where filtered_params is a function that filters the user parameters.
Conclusion
In conclusion, the CSRF vulnerability in rails-ujs (CVE-2020-8167) allows attackers to send CSRF tokens to wrong domains, potentially leading to unauthorized actions. It is important to update to fixed versions of the package and review/update any code that allows users to control the href or action attributes. Filtering user parameters can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for actionview →
FAQ
Versions of rails-ujs up to 6.0.3 are affected by this vulnerability.
No, applications that don't use rails-ujs are not affected by this vulnerability.
The impact can range from unauthorized data modifications to potential account takeovers, depending on the actions that can be performed with the CSRF token.
To fix this vulnerability, update to a fixed version of the rails-ujs package (rails >= 5.2.4.3 or rails >= 6.0.3.1) and review/update any code that allows users to control the href or action attributes.
Yes, a possible workaround is to filter the user parameters that control the href or action attributes to reduce the risk of sending the CSRF token to wrong domains.
Related vulnerabilities
Recent vulnerabilities recorded for actionview.
