CVE-2022-23633: Exposure of sensitive information in Action Pack

Published Feb 11, 2022

Updated

Impact

Under certain circumstances response bodies will not be closed, for example a bug in a webserver or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.

Upgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation.

Patches

This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

Workarounds

Upgrading is highly recommended, but to work around this problem the following middleware can be used:

ruby class GuardedExecutor < ActionDispatch::Executor def call(env) ensurecompleted! super end

private

def ensurecompleted! @executor.new.complete! if @executor.active? end end

Ensure the guard is inserted before ActionDispatch::Executor Rails.application.configure do config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor end

Other sources

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.

Reference:

https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9

— Red Hat

Affected Software

16 affected componentsFixes available

debian/rails<=2:6.0.3.7+dfsg-2, <=2:6.1.4.1+dfsg-8

debian/rails<=2:5.2.2.1+dfsg-1+deb10u3

2:5.2.2.1+dfsg-1+deb10u52:6.0.3.7+dfsg-2+deb11u22:6.1.7.3+dfsg-12:6.1.7.3+dfsg-2

redhat/rails<7.0.2.1

7.0.2.1

redhat/rails<6.1.4.5

6.1.4.5

redhat/rails<6.0.4.5

6.0.4.5

redhat/rails<5.2.6.1

5.2.6.1

rubygems/actionpack>=7.0.0.0<=7.0.2.1

7.0.2.2

rubygems/actionpack>=6.1.0.0<=6.1.4.5

6.1.4.6

rubygems/actionpack>=6.0.0.0<=6.0.4.5

6.0.4.6

rubygems/actionpack>=5.0.0.0<=5.2.6.1

5.2.6.2

rubyonrails Rails>=5.0.0<5.2.6.2

rubyonrails Rails>=6.0.0<6.0.4.6

rubyonrails Rails>=6.1.0<6.1.4.6

rubyonrails Rails>=7.0.0<7.0.2.2

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rails to a version that resolves this vulnerability.
Fixed in 2:5.2.2.1+dfsg-1+deb10u5Fixed in 2:6.0.3.7+dfsg-2+deb11u2Fixed in 2:6.1.7.3+dfsg-1Fixed in 2:6.1.7.3+dfsg-2
Upgrade
Upgrade redhat/rails to a version that resolves this vulnerability.
Fixed in 7.0.2.1
Upgrade
Upgrade redhat/rails to a version that resolves this vulnerability.
Fixed in 6.1.4.5
Upgrade
Upgrade redhat/rails to a version that resolves this vulnerability.
Fixed in 6.0.4.5
Upgrade
Upgrade redhat/rails to a version that resolves this vulnerability.
Fixed in 5.2.6.1
Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 7.0.2.2
Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 6.1.4.6
Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 6.0.4.6
Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 5.2.6.2
Upgrade
Upgrade debian/rails to a version that resolves this vulnerability.
Fixed in 2:5.2.2.1+dfsg-1+deb10u5
Upgrade
Upgrade debian/rails to a version that resolves this vulnerability.
Fixed in 2:6.0.3.7+dfsg-2+deb11u2
Upgrade
Upgrade debian/rails to a version that resolves this vulnerability.
Fixed in 2:6.1.7.3+dfsg-1
Upgrade
Upgrade debian/rails to a version that resolves this vulnerability.
Fixed in 2:6.1.7.3+dfsg-2
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-wh98-p28r-vrc9
Configuration
Implement the GuardedExecutor middleware as described and call config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor to insert the guard before ActionDispatch::Executor (per GHSA-wh98-p28r-vrc9).
Rails middleware (ActionDispatch::Executor) config.middleware.swap = ActionDispatch::Executor -> GuardedExecutor

Event History

Feb 11, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Advisory Published

via GitHub·08:49 PM

Data Sourced

via NVD·09:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2022-23633?

CVE-2022-23633 is a vulnerability in the Action Pack framework which can cause response bodies to not be closed under certain circumstances.

How does CVE-2022-23633 impact the system?

CVE-2022-23633 can result in response bodies not being closed, leading to potential information leakage and thread local variable pollution.

Which software versions are affected by CVE-2022-23633?

CVE-2022-23633 affects Rails versions 5.2.2.1 to 2:5.2.2.1+dfsg-1+deb10u5, 6.0.3.7 to 2:6.0.3.7+dfsg-2+deb11u2, and 6.1.7.3 to 2:6.1.7.3+dfsg-2.

How severe is CVE-2022-23633?

CVE-2022-23633 has a severity rating of 7.4 (high).

How can I fix CVE-2022-23633?

To fix CVE-2022-23633, it is recommended to update Rails to versions not affected by the vulnerability and apply any available patches.