CVE-2019-16782mediumCWE-208

CVE-2019-16782: medium-severity vulnerability in rack

Possible Information Leak / Session Hijack Vulnerability in Rack

Published 18 Dec 2019 · Updated 05 Aug 2024

Follow this CVE + Monitor rack + Monitor rack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 3.7%

In short

Rack's session system is vulnerable to timing attacks, allowing attackers to guess valid session IDs by measuring how long the server takes to respond. An attacker who finds a valid session ID can hijack that user's session.

Technical detail

CWE-208 timing attack vulnerability in Rack's session lookup mechanism. The backing store uses non-constant-time comparison for session ID validation, enabling an attacker to infer valid session IDs through precise timing measurements of database lookups. Successful exploitation allows session hijacking and account takeover without authentication.

Summary generated and translated by AI from the official description.

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

rack · rack

Related CVEs — rack

In the same product, most dangerous first.

CVE-2024-25126MEDIUMRack ReDos in content type parsing (2nd degree polynomial)EPSS 35.4%CVE-2024-26146MEDIUMPossible Denial of Service Vulnerability in Rack Header ParsingEPSS 2.0%CVE-2024-26141MEDIUMPossible DoS Vulnerability with Range Header in RackEPSS 1.6%CVE-2025-46727HIGHUnbounded-Parameter DoS in Rack::QueryParserEPSS 1.2%CVE-2025-25184MEDIUMPossible Log Injection in Rack::CommonLoggerEPSS 1.2%CVE-2025-27610HIGHLocal File Inclusion in Rack::StaticEPSS 1.2%

References

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38 https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZXMWILCICQLA2BYSP6I2CRMUG53YBLX/http://www.openwall.com/lists/oss-security/2019/12/18/2 http://www.openwall.com/lists/oss-security/2019/12/18/3 http://www.openwall.com/lists/oss-security/2019/12/19/3 http://www.openwall.com/lists/oss-security/2020/04/08/1 http://www.openwall.com/lists/oss-security/2020/04/09/2