CVE-2021-29435: 
Ruby vulnerability analysis and mitigation

A vulnerability in trestle-auth versions 0.4.0 and 0.4.1, an authentication plugin for the Trestle admin framework, was discovered that allows attackers to bypass Rails' built-in CSRF protection. The vulnerability was disclosed on April 12, 2021, and affects installations using these specific versions of the trestle-auth plugin (GitHub Advisory).

The vulnerability stems from incorrect ordering of CSRF protection and authentication before_actions in the controller. This implementation flaw allows attackers to create forms that bypass the built-in CSRF protection mechanisms when submitted by a victim who has an active trestle-auth admin session (GitHub Commit).

The vulnerability potentially allows attackers to alter protected data, including administrator account credentials, when exploited successfully. This could lead to unauthorized access and modifications to administrative resources within applications using the affected versions of trestle-auth (GitHub Advisory).

The exploit requires an attacker to create a malicious form and have a victim with an active trestle-auth admin session submit it. The vulnerability is classified as moderate severity, suggesting a moderate level of technical complexity for successful exploitation (GitHub Advisory).

The vulnerability has been fixed in trestle-auth version 0.4.2, which was released to RubyGems. The fix involves ensuring that CSRF protection is properly prepended before authentication before_actions. Users should upgrade to version 0.4.2 or later to mitigate this vulnerability (GitHub Advisory).