PT-2021-24462 · Unknown · Rucio-Webui

Published 2021-10-22 · Updated 2021-10-22

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: rucio-webui versions 1.26.0 through 1.26.6

Description: The issue potentially leaks the contents of cookies to other sessions within a wsgi container, specifically affecting Rucio authentication tokens. This allows users to access the webui with the leaked authentication token, resulting in privilege escalation. The Rucio server and daemons are not affected, and the issue is isolated to the webui.

Recommendations: For rucio-webui versions 1.26.0 through 1.26.6, update to version 1.26.7 to fix the issue. As a temporary workaround, consider installing the 1.25.7 webui release, as the 1.25 and previous webui release lines are not affected by this issue.

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-305

CWE-288

Related Identifiers

GHSA-V988-828W-XVF2

Affected Products

Rucio-Webui

References · 7

• https://osv.dev/vulnerability/GHSA-v988-828w-xvf2 · Vendor Advisory
• https://github.com/rucio/rucio · Note
• https://github.com/rucio/rucio/security/advisories/GHSA-v988-828w-xvf2 · Note
• https://github.com/rucio/rucio/commit/8f832404ae88d6300e17d7e706b40fe58e0df90c · Note
• https://github.com/rucio/rucio/issues/4810 · Note
• https://github.com/rucio/rucio/issues/4928 · Note
• https://github.com/rucio/rucio/releases/tag/1.26.7 · Note