CVE-2020-12480 - CSRF Content-Type black list bypass

[James Roper]

A vulnerability has been found in Play Framework's CSRF filter. If being used with a Content-Type blacklist (non default configuration), in certain situations, an attacker may be able to bypass the blacklist, by submitting a badly formed content type header.

This affects Play 2.6.x, 2.7.0-2.7.4, and 2.8.0-2.8.1. It is fixed in Play 2.7.5 and 2.8.2.

For details on this vulnerability, please see the advisory on the Play website:

https://www.playframework.com/security/vulnerability/CVE-2020-12480-CsrfBlacklistBypass

--

James Roper
Senior Architect, Cloudstate, Lightbend, Inc.
@jroper

I'm stuck in an email signature factory, please send help!