discourse/rails_multisite · Security
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application
- GHSA ID
- GHSA-844m-cpr9-jcmh
- CVE ID
- CVE-2021-41263
- Severity
- medium
- Published
- Updated
- CVSS
- 6.2 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H
- CVSS v3
- 6.2 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H
Description
Impact
This vulnerability impacts any Rails applications using rails_multisite alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application.
Patches
The issue has been patched in v4 of the rails_multisite gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
- CWE-565 · Reliance on Cookies without Validation and Integrity Checking
References
- https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh ↗
- https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2021-41263 ↗
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_multisite/CVE-2021-41263.yml ↗
- https://github.com/advisories/GHSA-844m-cpr9-jcmh ↗