PT-2009-4839 · Ruby · Ruby On Rails

N8 · Published 2009-07-10 · Updated 2024-02-13 · CVE-2009-2422

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 2.3.3

Description The issue concerns the digest authentication functionality in Ruby on Rails, where the example code defines an authenticate or request with http digest block that returns nil instead of false when the user does not exist. This allows attackers to bypass authentication for applications derived from this example by sending an invalid username without a password.

Recommendations For versions prior to 2.3.3, update to version 2.3.3 or later to resolve the issue. As a temporary workaround, consider modifying the authenticate or request with http digest block to return false when the user does not exist, instead of returning nil.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-2422

GHSA-RXQ3-GM4P-5FJ4

Affected Products

Ruby On Rails

References · 17

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2009-2422.yml · Exploit
• 🔥 http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s · Exploit
• https://osv.dev/vulnerability/CVE-2009-2422 · Vendor Advisory
• http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest · Patch
• http://vupen.com/english/advisories/2009/1802 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2422 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2422 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxq3-gm4p-5fj4 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2422 · Vendor Advisory
• http://securityfocus.com/bid/35579 · Patch
• http://secunia.com/advisories/35702 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2422 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51528 · Note
• https://web.archive.org/web/20090711160153/http://secunia.com/advisories/35702 · Note