GHSA-v988-828w-xvf2 Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui
Attackers can steal authentication tokens from other users via cookie leakage in the Rucio web UI, allowing unauthorized access and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-v988-828w-xvf2?
GHSA-v988-828w-xvf2 is an authentication bypass vulnerability in rucio-webui, published on 22 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
rucio-webui installations of the 1.26 release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the webui within a close timeframe, thus allowing users to access the webui with the leaked authentication token. Privileges are therefore also escalated.
Rucio server / daemons are not affected by this issue, it is isolated to the webui.
Patches
This issue is fixed in the 1.26.7 release of the rucio-webui.
Workarounds
Installation of the 1.25.7 webui release. The 1.25 and previous webui release lines are not affected by this issue.
References
Which versions are affected by GHSA-v988-828w-xvf2?
2 open source packages ship an affected version, including rucio-webui.
| Package | Affected | Fixed in |
|---|---|---|
rucio-webui PyPI | From 1.26.0 | 1.26.7 |
rucio-webui PyPI | From 1.26.0 | 1.26.7 |
How do I fix GHSA-v988-828w-xvf2?
Upgrade rucio-webui to 1.26.7 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-v988-828w-xvf2 being exploited?
There is no known exploitation of GHSA-v988-828w-xvf2 in the wild and no public exploit code.