CVE-2023-34090: Decidim vulnerable to sensitive data disclosure
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.
Other sources
Note: added the actual report as a comment.
Summary
Decidim, a platform for digital citizen participation, uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table).
Impact This issue may lead to Sensitive Data Disclosure.
Patches The problem was patched in v0.27.3.
Workarounds Disable or unpublish all meetings components from your application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/decidim-meetingsto a version that resolves this vulnerability.Fixed in 0.27.3 - Upgrade
Upgrade
rubygems/decidimto a version that resolves this vulnerability.Fixed in 0.27.3 - Upgrade
Upgrade
decidim/decidimto a version that resolves this vulnerability.Fixed in 0.27.3 - Configuration
Disable or unpublish all meetings components from your application.
Decidim meetings components public availability of meetings components (unpublish/disable) = disabled/unpublished
Event History
Frequently Asked Questions
What is CVE-2023-34090?
CVE-2023-34090 is a vulnerability in the Decidim platform that allows attackers to perform unauthorized filtering of database collections.
What is the severity of CVE-2023-34090?
CVE-2023-34090 has a severity level of high.
How does CVE-2023-34090 affect Decidim?
CVE-2023-34090 affects Decidim versions up to and excluding 0.27.3.
How can I fix CVE-2023-34090?
To fix CVE-2023-34090, update Decidim to version 0.27.3 or higher.
Are there any references for CVE-2023-34090?
Yes, you can find references for CVE-2023-34090 at the following links: [Link 1](https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110), [Link 2](https://github.com/decidim/decidim/releases/tag/v0.27.3), [Link 3](https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9).