Patchfirst
Patchfirst
CVE-2019-16782 Medium · 6.3 EPSS 3.7%

Possible Information Leak / Session Hijack Vulnerability in Rack

rack · rack

Official description · CVE.org

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

Breakdown
22.4 / 100
Exploited
Not confirmed
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

Disclosed on 18 Dec 2019. No public exploit code or confirmed exploitation is recorded.

2 related vulnerabilities in the same code over 15 months. The latest fix listed for rack is 2.2.3.1.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2019-16782Possible Information Leak / Session Hijack Vulnerability in Rack18 Dec 2019
  2. relatedLow

    Why these are linked:

    • Stated in the CVE textThis is a related issue to CVE-2019-16782.
    CVE-2019-25025The activerecord-session_store (aka Active Record Session Store)…5 Mar 2021

Fixes in rackRubyGems package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 1.6.2CVE-2015-322526 Jul 2015
  2. 2.0.6CVE-2018-1647013 Nov 2018
  3. 2.0.6CVE-2018-1647113 Nov 2018
  4. 2.0.8CVE-2019-1678218 Dec 2019
  5. 2.1.3CVE-2020-81612 Jul 2020
  6. 2.2.3CVE-2020-818419 Jun 2020
  7. 2.2.3.1CVE-2022-301225 Dec 2022Latest listed

techniques

2 , grouped by in kill-chain order 2

Credential AccessTA0006

Brute Force T1110
MITRE CTID mapping of the CVE · how it is exploited

Lateral MovementTA0008

Remote Service Session Hijacking T1563
MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 25 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-16782 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Brute ForceT111025 general rules
All 25 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: rack.

RubyGemsrackGHSA-hrqr-hxpp-chr3

Upgrade to 2.0.8 or later

Gemfilegem "rack", ">= 2.0.8"

The first fix for CVE-2019-16782. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you runUpgrade to
2.0.0 up to 2.0.82.0.8
All versions before 1.6.121.6.12

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

9 links, grouped by NVD tag

x_refsource_CONFIRM 2

github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38

mailing-list 5

openwall.com/lists/oss-security/2019/12/18/3openwall.com/lists/oss-security/2019/12/18/2openwall.com/lists/oss-security/2019/12/19/3openwall.com/lists/oss-security/2020/04/08/1openwall.com/lists/oss-security/2020/04/09/2

vendor-advisory 2

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZXMWILCICQLA2BYSP6I2CRMUG53YBLX/lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html
↑ ↓ chooseEnter openEsc close