PT-2024-13556 · Unknown+2 · Decidim-Admin+3

Ctrgrb · Published 2024-02-20 · Updated 2024-12-16 · CVE-2023-48220

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions decidim versions 0.0.1.alpha3 through 0.26.8 decidim-admin versions 0.0.1.alpha3 through 0.26.8 decidim-system versions 0.0.1.alpha3 through 0.26.8 devise invitable versions 0.4.rc3 through 2.0.8

Description The invites feature in the devise invitable gem allows users to accept invitations for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies in the decidim, decidim-admin, and decidim-system gems. When using the password reset functionality, the devise invitable gem always accepts the pending invitation if the user has been invited, without ensuring that the pending invitation is still valid as defined by the invite for expiry period. Decidim sets this configuration to 2.weeks, which should be respected.

Recommendations For decidim versions 0.0.1.alpha3 through 0.26.8, update to version 0.26.9 or above. For decidim-admin versions 0.0.1.alpha3 through 0.26.8, update to version 0.26.9 or above. For decidim-system versions 0.0.1.alpha3 through 0.26.8, update to version 0.26.9 or above. For devise invitable versions 0.4.rc3 through 2.0.8, update to version 2.0.9 or above. As a temporary workaround, invitations can be cancelled directly from the database by running the command: Decidim::User.invitation not accepted.update all(invitation token: nil)

Exploit

Fix

Weakness Enumeration

CWE-672

Related Identifiers

CVE-2023-48220

GHSA-W3Q8-M492-4PWP

Affected Products

Decidim

Decidim-Admin

Decidim-System

Devise Invitable

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48220.json · Exploit
• https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098 · Patch
• https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp · Vendor Advisory
• https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34 · Patch
• https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454 · Patch
• https://osv.dev/vulnerability/GHSA-w3q8-m492-4pwp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48220 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48220 · Vendor Advisory
• https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198 · Note
• https://github.com/decidim/decidim · Note
• https://github.com/decidim/decidim/releases/tag/v0.26.9 · Note
• https://github.com/decidim/decidim/releases/tag/v0.28.0 · Note
• https://github.com/decidim/decidim/releases/tag/v0.27.5 · Note
• https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134 · Note
• https://twitter.com/rubylandnews/status/1760414191184183353 · Twitter Post