PT-2021-23224 · Rubygems · Rails Multisite

Jomaxro · Published 2021-11-15 · Updated 2022-08-09 · CVE-2021-41263

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions rails multisite versions prior to 4

Description The issue impacts Rails applications using rails multisite alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application.

Recommendations For versions prior to 4, upgrade to v4 of the rails multisite gem. Note that this upgrade will invalidate all previous signed/encrypted cookies, and the impact of this invalidation will vary based on the application architecture. As a temporary workaround, consider restricting access to signed/encrypted cookies until the upgrade is applied.

Exploit

Fix

Information Disclosure

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-565

CWE-200

CWE-327

Related Identifiers

CVE-2021-41263

GHSA-844M-CPR9-JCMH

Affected Products

Rails Multisite

References · 9

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_multisite/CVE-2021-41263.yml · Exploit
• https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41263 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41263 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-844m-cpr9-jcmh · Vendor Advisory
• https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh · Note
• https://github.com/discourse/rails_multisite · Note
• https://t.me/cibsecurity/32474 · Telegram Post
• https://t.me/cvenotify/34436 · Telegram Post