CVE-2023-47634 Decidim has race condition in Endorsements

Low 3.1 Published 20 Feb 2024 Updated 2 Aug 2024

A race condition in Decidim allows users to bypass single-endorsement limits by sending parallel requests, enabling multiple endorsements for a single resource.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-47634?

CVE-2023-47634 is a low-severity vulnerability in decidim, published on 20 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components.

Weakness: CWE-362

Which versions are affected by CVE-2023-47634?

4 open source packages ship an affected version, including decidim. It affects 1 product.

Package	Affected	Fixed in
`decidim` RubyGems	From `0.10.0`	`0.26.9`
`decidim` RubyGems	From `0.10.0`	`0.26.9`
`decidim` RubyGems	From `0.27.0`	`0.27.5`
`decidim` RubyGems	From `0.27.0`	`0.27.5`

Products include Decidim Decidim.

How do I fix CVE-2023-47634?

Upgrade decidim to a fixed version for your release line: 0.26.9 or 0.27.5.

Is CVE-2023-47634 being exploited?

There is no known exploitation of CVE-2023-47634 in the wild and no public exploit code.

Sources

Also known as GHSA-r275-j57c-7mf2.