CVE-2020-8167: 
Ruby vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the rails-ujs module of Ruby on Rails versions 6.0.3 and earlier. The vulnerability, identified as CVE-2020-8167, was disclosed on May 18, 2020, and allows attackers to send CSRF tokens to incorrect domains. This is a regression of a previous vulnerability (CVE-2015-1840) (Ruby Rails Security).

The vulnerability exists in scenarios where an attacker can control the href attribute of an anchor tag or the action attribute of a form tag that triggers a POST action. In such cases, the attacker can set the href or action to a cross-origin URL, causing the CSRF token to be sent to unintended domains. The issue affects applications using the rails-ujs module in Rails versions 6.0.3 and earlier (Ruby Rails Security).

When exploited, this vulnerability could allow attackers to perform cross-site request forgery attacks by manipulating CSRF token destinations, potentially leading to unauthorized actions being performed on behalf of authenticated users (Ruby Rails Security).

The vulnerability can be exploited in applications where users have control over href attributes of anchor tags or action attributes of form tags that trigger POST actions. Applications that don't use rails-ujs are not affected by this vulnerability (Ruby Rails Security).

The vulnerability has been fixed in Rails versions 5.2.4.3 and 6.0.3.1. For users unable to upgrade immediately, a workaround is available by implementing parameter filtering for user-controlled href and action attributes. This can be achieved by changing code that allows users to control these attributes to filter user parameters through a trusted parameter filtering function (Ruby Rails Security, Debian Security).