PT-2022-16147 · Unknown+6 · Action Pack+8
Tenderlove
·
Published
2022-02-11
·
Updated
2025-09-29
·
CVE-2022-23633
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Rails versions prior to 7.0.2.2
Rails versions prior to 6.1.4.6
Rails versions prior to 6.0.4.6
Rails versions prior to 5.2.6.2
Puma versions prior to 5.6.2
Puma versions prior to 4.3.11
Description
Action Pack is a framework for handling and responding to web requests. Under certain circumstances, response bodies will not be closed. In the event a response is not notified of a
close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes. The combination of Puma not closing the body and Rails' Executor implementation causes information leakage.Recommendations
For Rails versions prior to 7.0.2.2, upgrade to version 7.0.2.2 or later.
For Rails versions prior to 6.1.4.6, upgrade to version 6.1.4.6 or later.
For Rails versions prior to 6.0.4.6, upgrade to version 6.0.4.6 or later.
For Rails versions prior to 5.2.6.2, upgrade to version 5.2.6.2 or later.
For Puma versions prior to 5.6.2, upgrade to version 5.6.2 or later.
For Puma versions prior to 4.3.11, upgrade to version 4.3.11 or later.
As a temporary workaround, consider using the middleware described in GHSA-wh98-p28r-vrc9 to mitigate the issue.
Alternatively, you can use the following middleware:
class GuardedExecutor < ActionDispatch::Executor
def call(env)
ensure completed!
super
end
private
def ensure completed!
@executor.new.complete! if @executor.active?
end
end
# Ensure the guard is inserted before ActionDispatch::Executor
Rails.application.configure do
config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor
endExploit
Fix
Improper Resource Release
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Action Pack
Actiondispatch::Executor
Activesupport::Currentattributes
Astra Linux
Puma
Rails
Rocky Linux
Suse