CVE-2024-26144: Possible Sensitive Session Information Leak in Active Storage
First published: Mon Feb 26 2024(Updated: )
# Possible Sensitive Session Information Leak in Active Storage There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a `Set-Cookie` header along with the user's session cookie when serving blobs. It also sets `Cache-Control` to public. Certain proxies may cache the Set-Cookie, leading to an information leak. This vulnerability has been assigned the CVE identifier CVE-2024-26144. Versions Affected: >= 5.2.0, < 7.1.0 Not affected: < 5.2.0, > 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7 Impact ------ A proxy which chooses to caches this request can cause users to share sessions. This may include a user receiving an attacker's session or vice versa. This was patched in 7.1.0 but not previously identified as a security vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Upgrade to Rails 7.1.X, or configure caching proxies not to cache the Set-Cookie headers. Credits ------- Thanks to [tyage](https://hackerone.com/tyage) for reporting this!
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/activestorage | >=7.0.0<7.0.8.1 | 7.0.8.1 |
| rubygems/activestorage | >=5.2.0<6.1.7.7 | 6.1.7.7 |
| redhat/rubygem-activestorage | <7.0.8.1 | 7.0.8.1 |
| redhat/rubygem-activestorage | <6.1.7.7 | 6.1.7.7 |
| Ruby on Rails | >=5.2.0<6.1.7.7 | |
| Ruby on Rails | >=7.0.0<7.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945
- https://github.com/rails/rails/commit/723f54566023e91060a67b03353e7c03e7436433
- https://github.com/rails/rails/commit/78fe149509fac5b05e54187aaaef216fbb5fd0d3
- https://github.com/rails/rails/security/advisories/GHSA-8h22-8cf7-hq6g
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2024-26144.yml
- https://security.netapp.com/advisory/ntap-20240510-0013/
- https://nvd.nist.gov/vuln/detail/CVE-2024-26144
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26144.yml
- https://security.netapp.com/advisory/ntap-20240510-0013
- https://github.com/advisories/GHSA-8h22-8cf7-hq6g (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266082
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266083
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266084
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266085
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266086
- https://access.redhat.com/errata/RHSA-2024:10806
- https://bugzilla.redhat.com/show_bug.cgi?id=2266063
Frequently Asked Questions
What is the severity of CVE-2024-26144?
CVE-2024-26144 is classified as a possible information leak vulnerability that can expose sensitive session information.
How do I fix CVE-2024-26144?
To fix CVE-2024-26144, upgrade Active Storage to version 7.0.8.1 or 6.1.7.7 or higher.
Which versions of Active Storage are affected by CVE-2024-26144?
Versions of Active Storage from 5.2.0 to 7.0.8.0 and from 6.1.0 to 6.1.7.6 are affected by CVE-2024-26144.
What platforms are impacted by CVE-2024-26144?
CVE-2024-26144 impacts both the rubygems and redhat packages of Active Storage.
Is a workaround available for CVE-2024-26144?
There is no specific workaround for CVE-2024-26144; upgrading to the fixed versions is recommended.
- agent/title
- agent/weakness
- agent/type
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8h22-8cf7-hq6g
- alias/CVE-2024-26144
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/trending
- agent/source
- agent/remedy
- agent/last-modified-date
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/rubygems
- package-manager/redhat
- vendor/rubyonrails
- canonical/ruby on rails
- version/ruby on rails/5.2.0
- version/ruby on rails/7.0.0