CVE-2019-16782

Possible Information Leak / Session Hijack Vulnerability in Rack

CVSS 6.3 MEDIUMEPSS 3.7%CWE-208

In short

Rack's session system is vulnerable to timing attacks, allowing attackers to guess valid session IDs by measuring how long the server takes to respond. An attacker who finds a valid session ID can hijack that user's session.

Technical detail

CWE-208 timing attack vulnerability in Rack's session lookup mechanism. The backing store uses non-constant-time comparison for session ID validation, enabling an attacker to infer valid session IDs through precise timing measurements of database lookups. Successful exploitation allows session hijacking and account takeover without authentication.

Summary generated and translated by AI from the official description.

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

rack · rack

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38 https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZXMWILCICQLA2BYSP6I2CRMUG53YBLX/http://www.openwall.com/lists/oss-security/2019/12/18/2 http://www.openwall.com/lists/oss-security/2019/12/18/3 http://www.openwall.com/lists/oss-security/2019/12/19/3 http://www.openwall.com/lists/oss-security/2020/04/08/1 http://www.openwall.com/lists/oss-security/2020/04/09/2