CVE-2021-29481 Information

Description

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0 the default configuration of client side sessions results in unencrypted but signed data being set as cookie values. This means that if something sensitive goes into the session it could be read by something with access to the cookies. For this to be a vulnerability some kind of sensitive data would need to be stored in the session and the session cookie would have to leak. For example the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allowed capture of the cookies. As of version 1.9.0 a securely randomly generated signing key is used. As a workaround one may supply an encryption key as per the documentation recommendation.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Reference

https://github.com/ratpack/ratpack/pull/1590 https://github.com/ratpack/ratpack/security/advisories/GHSA-phj8-4cq3-794g

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

7.5