Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2024-26144: Rails Active Storage may expose session cookies
CVE-2024-26144 · published 2 years ago
Summary
Web applications using Rails' Active Storage feature from version 5.2.0 can unintentionally send a user’s session cookie in responses that are publicly cached. This could allow other users to obtain that cookie and impersonate the victim. Upgrade Rails to version 6.1.7.7 or later (or 7.0.8.1 or later) to stop the cookie from being cached.
What to do
- Update david heinemeier hansson activestorage to version 6.1.7.7.
- Update david heinemeier hansson activestorage to version 7.0.8.1.
- Update debian rails to version 2:6.1.7.10+dfsg-1~deb12u1.
- Update debian rails to version 2:7.2.2.1+dfsg-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | david heinemeier hansson | activestorage |
>= 5.2.0, < 6.1.7.7 >= 7.0.0, < 7.0.8.1 Fix: upgrade to 6.1.7.7
|
| – | rubyonrails | rails |
>= 5.2.0, < 6.1.7.7 >= 7.0.0, < 7.1.0 cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* |
| Debian:12 | debian | rails |
< 2:6.1.7.10+dfsg-1~deb12u1 Fix: upgrade to 2:6.1.7.10+dfsg-1~deb12u1
|
| Debian:13 | debian | rails |
< 2:7.2.2.1+dfsg-1 Fix: upgrade to 2:7.2.2.1+dfsg-1
|
| Ubuntu:Pro:16.04:LTS | canonical | rails | All versions |
Original advisory text
Possible Sensitive Session Information Leak in Active Storage
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.
References
- https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in... Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-26144 Vendor Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024...
- https://security.netapp.com/advisory/ntap-20240510-0013
- https://github.com/rails/rails/security/advisories/GHSA-8h22-8cf7-hq6g Third Party Advisory
- https://github.com/advisories/GHSA-8h22-8cf7-hq6g
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26144... Vendor Advisory
- https://security.netapp.com/advisory/ntap-20240510-0013/ Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2024-26144 Vendor Advisory
- https://ubuntu.com/security/CVE-2024-26144 Third Party Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2... Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-26144 Third Party Advisory
- https://github.com/rails/rails/commit/723f54566023e91060a67b03353e7c03e7436433 Third Party Advisory
- https://github.com/rails/rails/commit/78fe149509fac5b05e54187aaaef216fbb5fd0d3 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-200Information Exposure
Timeline
Published27 Feb 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-8h22-8cf7-hq6g · GHSA
CVE-2024-26144 · NVD
CVE-2024-26144 · OSV
DEBIAN-CVE-2024-26144 · OSV
UBUNTU-CVE-2024-26144 · OSV
Track software like this
Free during beta