PT-2021-18242 · Ratpack · Ratpack

Jlleitschuh + 1 · Published 2021-06-29 · Updated 2022-08-02 · CVE-2021-29480

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Ratpack versions prior to 1.9.0

Description: The client side session module in Ratpack uses the application startup time as the signing key by default. If an attacker can determine this time and encryption is not used, the session data could be tampered with by someone with the ability to write cookies. The default configuration is unsuitable for production use as an application restart renders all sessions invalid and is not multi-host compatible.

Recommendations: For versions prior to 1.9.0, supply an alternative signing key, as per the documentation's recommendation. For versions prior to 1.9.0, consider updating to Ratpack 1.9.0 or later, which uses a securely randomly generated value as the default signing key.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-340

CWE-330

Related Identifiers

CVE-2021-29480

GHSA-2CC5-23R7-VC4V

Affected Products

Ratpack

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-29480 · Security Note
• https://osv.dev/vulnerability/GHSA-2cc5-23r7-vc4v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29480 · Vendor Advisory
• https://github.com/ratpack/ratpack/security/advisories/GHSA-2cc5-23r7-vc4v · Note
• https://github.com/ratpack/ratpack/blob/29434f7ac6fd4b36a4495429b70f4c8163100332/ratpack-session/src/main/java/ratpack/session/clientside/ClientSideSessionConfig.java#L29 · Note
• https://github.com/ratpack/ratpack · Note
• https://t.me/cibsecurity/25802 · Telegram Post