CSRF Content-Type black list bypass
10 August 2020
In some situations, Play’s
contentType.blackList for Cross-Site Request Forgery (CSRF) protection could be bypassed by sending a malformed
This only impacts Play applications that use Play’s built in CSRF filter, and have configured a black list of Content-Types for CSRF protection. In Play’s default configuration, a black list is not configured, rather, all requests have CSRF protection applied regardless of content types, and so this vulnerability does not impact applications that use the default configuration.
If a black list is used, the result is that a malicious user may be able to perform a CSRF attack on the Play application.
- Play 2.8.0-2.8.1
- Play 2.7.0-2.7.4
- Play 2.6.x
This issue is fixed on Play 2.8.2 and 2.7.5. There won’t be a 2.6.x release with this fix since this version has reached end-of-support, please upgrade as soon as possible to avoid this security issue.
CVSS Metrics (more info)
Credit for finding this vulnerability goes to Kevin Joensen from https://www.doyensec.com/.