GHSA-44vf-8ffm-v2qh Sensitive Data Exposure in rails-session-decoder
Missing MAC verification in rails-session-decoder allows attackers to decrypt cookies and expose sensitive encrypted information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-44vf-8ffm-v2qh?
GHSA-44vf-8ffm-v2qh is a vulnerability in rails-session-decoder, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of rails-session-decoder are missing verification of the Message Authentication Code appended to the cookies. This may lead to decryption of cipher text thus exposing encrypted information.
Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.
Which versions are affected by GHSA-44vf-8ffm-v2qh?
2 open source packages ship an affected version, including rails-session-decoder.
| Package | Affected | Fixed in |
|---|---|---|
rails-session-decoder npm | From 0.0.0 | None |
rails-session-decoder npm | From 0.0.0 | None |
How do I fix GHSA-44vf-8ffm-v2qh?
No fix has been published for GHSA-44vf-8ffm-v2qh yet. Limit exposure of the affected software until one is available.
Is GHSA-44vf-8ffm-v2qh being exploited?
There is no known exploitation of GHSA-44vf-8ffm-v2qh in the wild and no public exploit code.