Spree Auth Devise Schwachstelle ermöglicht Authentifizierungsbypass durch CSRF-Schwäche

The primary impact of CVE-2021-41275 is the potential for complete user account takeover. An attacker can craft malicious requests that, when triggered by a logged-in user, execute actions as that user without their knowledge or consent. This could include modifying user profiles, changing passwords, placing orders, or accessing sensitive data. The vulnerability is particularly concerning because it affects the frontend component of Spree Auth Devise, a widely used authentication library in Ruby on Rails applications. The combination of protectfromforgery being executed as a beforeaction callback and the use of :nullsession or :reset_session strategies creates a perfect storm for CSRF exploitation. Successful exploitation requires the attacker to trick the user into visiting a malicious website or clicking a crafted link.

Applications built with Ruby on Rails that utilize the Spree Auth Devise gem, particularly those relying on the frontend component, are at risk. Specifically, applications using default configurations or those that have not explicitly configured protectfromforgery with robust settings are highly vulnerable. Shared hosting environments where application configurations are less controllable also present a heightened risk.

• ruby / server:

# Check for Spree Auth Devise version
require 'spree_auth_devise'
puts Spree::Auth::Devise.version

• ruby / server:

# Inspect application configuration for protect_from_forgery settings
# Look for configurations using :null_session or :reset_session

• generic web:

# Check for suspicious requests in access logs
# Look for requests with unexpected parameters or origins
grep -i 'spree_auth_devise' /var/log/nginx/access.log

1. 2021-11-18Disclosure

   disclosure

2. 2021-11-18Patch

   patch

1. Reserviert2021-09-15
2. Veröffentlicht2021-11-18
3. Geändert2026-03-13
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2021-41275 is to upgrade to version 4.4.1 or later of Spree Auth Devise. If upgrading is not immediately feasible, consider implementing temporary workarounds. Ensure that the protectfromforgery method is correctly configured and that the session management strategy is not vulnerable to CSRF attacks. Review your application's session handling logic and implement additional CSRF protection measures, such as using custom CSRF tokens or implementing stricter session validation. If using a web application firewall (WAF), configure rules to detect and block CSRF attacks targeting Spree Auth Devise endpoints. After upgrading, confirm the fix by attempting a CSRF attack against a test user account and verifying that the attack is blocked.