GHSA-rxq3-gm4p-5fj4 CVE-2009-2422
rails vulnerable to improper authentication
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 3.38%
- Chance of exploitation in the next 30 days. Higher than 88.77% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-287 Improper Authentication
- Fix
2.3.3- Upgrade rails to this version or later
Description
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| rails | < 2.3.3 |
2.3.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rails RubyGems → 2.3.3
- bundler
bundle update rails # Gemfile: gem "rails", ">= 2.3.3"
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
References
Advisories
Other links
- exchange.xforce.ibmcloud.com/vulnerabilities/51528
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2009-2422.yml
- web.archive.org/web/20090711160153/http://secunia.com/advisories/35702
- web.archive.org/web/20200229192617/http://www.securityfocus.com/bid/35579
- lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s
- support.apple.com/kb/HT4077
- weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9822-6m93-xqf4 Rails has possible XSS Vulnerability in Action Controller | Medium | Also affects rails |
| GHSA-rvpq-5xqx-pfpp Ruby on Rails vulnerable to code injection | High | Also affects rails |
| GHSA-jmgf-p46x-982h rails is vulnerable to CRLF injection | Medium | Also affects rails |
| GHSA-p4c6-77gc-694x session fixation protection mechanism in cgi_process.rb in Rails | Medium | Also affects rails |
| GHSA-jwhv-rgqc-fqj5 Session fixation vulnerability in Rails | Medium | Also affects rails |
| GHSA-fjfg-q662-gm6j Moderate severity vulnerability that affects rails | Medium | Also affects rails |
| GHSA-gm25-fpmr-43fj Moderate severity vulnerability that affects rails | Medium | Also affects rails |
| GHSA-9wrq-xvmp-xjc8 Rails Denial of Service vulnerability | High | Also affects rails |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor