PT-2021-18243 · Ratpack · Ratpack

Jl Leitschuh + 1 · Published 2021-06-29 · Updated 2021-07-07 · CVE-2021-29481

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Ratpack versions prior to 1.9.0

Description: The default configuration of client-side sessions in Ratpack results in unencrypted, but signed, data being set as cookie values. This could allow sensitive data to be read by something with access to the cookies, if sensitive data is stored in the session and the session cookie leaks. For example, this could happen if the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allows capture of the cookies.

Recommendations: For versions prior to 1.9.0, supply an encryption key as per the documentation recommendation to mitigate the issue. As of version 1.9.0, a securely randomly generated signing key is used, which resolves the issue.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-29481

GHSA-PHJ8-4CQ3-794G

Affected Products

Ratpack

References · 6

• https://github.com/ratpack/ratpack/pull/1590 · Patch
• https://osv.dev/vulnerability/CVE-2021-29481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29481 · Security Note
• https://osv.dev/vulnerability/GHSA-phj8-4cq3-794g · Vendor Advisory
• https://github.com/ratpack/ratpack/security/advisories/GHSA-phj8-4cq3-794g · Note
• https://github.com/ratpack/ratpack · Note