CVE-2019-25025 Activerecord-session_store Vulnerable to Timing Attack
Remote attackers can guess valid session IDs via timing side-channels, potentially leading to account takeover in Ruby on Rails applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25025?
CVE-2019-25025 is a medium-severity vulnerability in n/a, published on 5 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.
Which versions are affected by CVE-2019-25025?
2 open source packages ship an affected version, including activerecord-session_store. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
activerecord-session_store RubyGems | All versions | 2.0.0 |
activerecord-session_store RubyGems | All versions | 2.0.0 |
Products include Rubyonrails Active Record Session Store.
How do I fix CVE-2019-25025?
Upgrade activerecord-session_store to 2.0.0 or later.
Is CVE-2019-25025 being exploited?
There is no known exploitation of CVE-2019-25025 in the wild and no public exploit code.
Sources
Also known as GHSA-cvw2-xj8r-mjf7, UBUNTU-CVE-2019-25025.