Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2009-2422: Ruby on Rails Digest Auth Bypass
CVE-2009-2422 · published 17 years ago
Summary
A weakness in the example code for digest authentication in Ruby on Rails versions before 2.3.3 allows attackers to bypass authentication. This affects applications that use this example code, making it possible for unauthorized users to access protected content. To fix this, update to Rails version 2.3.3 or later.
What to do
- Update david heinemeier hansson rails to version 2.3.3.
- Update rubyonrails ruby_on_rails to version 2.3.3 or later.
- Update apple mac_os_x to version 10.6.3 or later.
- Update apple mac_os_x_server to version 10.6.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | david heinemeier hansson | rails |
< 2.3.3 Fix: upgrade to 2.3.3
|
| – | rubyonrails | ruby_on_rails |
< 2.3.3 cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:* |
| – | apple | mac_os_x |
>= 10.6.0, < 10.6.3 10.5.8 cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* |
| – | apple | mac_os_x_server |
>= 10.6.0, < 10.6.3 10.5.8 cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:* |
Original advisory text
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instea...
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
References
- https://nvd.nist.gov/vuln/detail/CVE-2009-2422
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51528
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s
- http://support.apple.com/kb/HT4077
- http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_h...
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2009-2422...
- https://web.archive.org/web/20090711160153/http://secunia.com/advisories/35702
- https://web.archive.org/web/20200229192617/http://www.securityfocus.com/bid/3557...
- https://github.com/advisories/GHSA-rxq3-gm4p-5fj4
- http://secunia.com/advisories/35702 Broken Link Vendor Advisory
- http://www.securityfocus.com/bid/35579 Broken Link Patch Third Party Advisory VDB Entry
- http://www.vupen.com/english/advisories/2009/1802 Broken Link Patch Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-287Improper Authentication
Timeline
Published10 Jul 2009
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta