CVE-2021-29481 Client side sessions should not allow unencrypted storage
Attackers can read sensitive session data from unencrypted cookies if they leak, affecting developers using Ratpack web toolkit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-29481?
CVE-2021-29481 is a medium-severity vulnerability in ratpack, published on 29 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with access to the cookies. For this to be a vulnerability, some kind of sensitive data would need to be stored in the session and the session cookie would have to leak. For example, the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allowed capture of the cookies. As of version 1.9.0, a securely randomly generated signing key is used. As a workaround, one may supply an encryption key, as per the documentation recommendation.
Weakness: CWE-312
Which versions are affected by CVE-2021-29481?
2 open source packages ship an affected version, including io.ratpack:ratpack-session. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.ratpack:ratpack-session Maven | All versions | 1.9.0 |
io.ratpack:ratpack-session Maven | All versions | 1.9.0 |
Products include Ratpack Project Ratpack.
How do I fix CVE-2021-29481?
Upgrade io.ratpack:ratpack-session to 1.9.0 or later.
Is CVE-2021-29481 being exploited?
There is no known exploitation of CVE-2021-29481 in the wild and no public exploit code.
Other vulnerabilities in ratpack
- CVE-2021-29485 Remote Code Execution Vulnerability in Session Storage
- CVE-2019-17513 io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')
- CVE-2021-29479 Cached redirect poisoning via X-Forwarded-Host header
- CVE-2021-29480 Default client side session signing key is highly predictable
- CVE-2019-11808 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack
Sources
Also known as GHSA-phj8-4cq3-794g.