Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session data without knowledge of any configured secret. Because this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access. This vulnerability is fixed in 2.1.2.
When secrets are configured and decryption of the session cookie fails, the implementation instead of rejecting the cookie, falls back to the default decoder. An attacker can therefore provide a crafted session cookie that will be accepted and processed without knowledge of the configured secret. Since this mechanism is used to load session state, the attacker gains control over the session content.
An attacker can manipulate web application session data and gain unauthorized access to resources or functions requiring authentication. It is also possible to escalate privileges by substituting session content.
The rack-session library should be updated to version 2.1.2 or newer, where the vulnerability has been fixed.
Rack::Session (rack-session) in versions from 2.0.0 to 2.1.1 (before 2.1.2)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XRack Session
APPRack2.0.0 – 2.1.2 (excl.)
Related vulnerabilities
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determi...
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Par...
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3...
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s ...
Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST`...