CVE-2020-16252: 
Ruby vulnerability analysis and mitigation

The Field Test gem versions 0.2.0 through 0.3.2 for Ruby contains a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability was discovered and disclosed on August 4, 2020, affecting the Field Test dashboard when using non-session based authentication methods. The issue was assigned CVE-2020-16252 and was fixed in version 0.4.0 (GitHub Issue).

The vulnerability stems from the Field Test dashboard's implementation of CSRF protection. The application uses Rails' protect_from_forgery method, which defaults to :null_session. This default setting has no effect on non-session based authentication methods, such as basic authentication. The vulnerability received a CVSS v3.1 Base Score of 4.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) (NVD).

The vulnerability allows attackers to perform CSRF attacks against users of the Field Test dashboard who are using non-session based authentication methods. When exploited, an attacker could trick an authorized user into visiting a malicious website that performs unauthorized requests on their behalf. Specifically, the vulnerability affects a single endpoint that allows changing the variant assigned to a user (GitHub Issue).

The vulnerability is exploitable when an authenticated user visits a malicious website while logged into the Field Test dashboard using non-session based authentication. It's important to note that session-based authentication methods, such as Devise's default authentication, are not affected by this vulnerability (GitHub Issue).

The vulnerability was fixed in Field Test version 0.4.0 by changing the protect_from_forgery implementation to use :exception instead of :null_session. Users running affected versions (0.2.0 through 0.3.2) should upgrade immediately to version 0.4.0 or later to address this security issue (GitHub Issue).