Vulnerability Description
better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks. As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent). Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3". There are no known workarounds to mitigate the risk of using older releases of better_errors.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Better Errors Project | Better Errors | < 2.8.0 |
Related Weaknesses (CWE)
References
- https://github.com/BetterErrors/better_errors/commit/8e8e796bfbde4aa088741823c8aPatchThird Party Advisory
- https://github.com/BetterErrors/better_errors/discussions/507Third Party Advisory
- https://github.com/BetterErrors/better_errors/pull/474PatchThird Party Advisory
- https://github.com/BetterErrors/better_errors/security/advisories/GHSA-w3j4-76qwThird Party Advisory
- https://github.com/BetterErrors/better_errors/commit/8e8e796bfbde4aa088741823c8aPatchThird Party Advisory
- https://github.com/BetterErrors/better_errors/discussions/507Third Party Advisory
- https://github.com/BetterErrors/better_errors/pull/474PatchThird Party Advisory
- https://github.com/BetterErrors/better_errors/security/advisories/GHSA-w3j4-76qwThird Party Advisory
FAQ
What is CVE-2021-39197?
CVE-2021-39197 is a vulnerability with a CVSS score of 6.3 (MEDIUM). better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. better_erro...
How severe is CVE-2021-39197?
CVE-2021-39197 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-39197?
Check the references section above for vendor advisories and patch information. Affected products include: Better Errors Project Better Errors.