CVE-2025-32441

{"id": "CVE-2025-32441", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "published": "2025-05-07T23:15:53.537", "references": [{"url": "https://github.com/rack/rack/blob/v2.2.13/lib/rack/session/abstract/id.rb#L263-L270", "source": "security-advisories@github.com"}, {"url": "https://github.com/rack/rack/commit/c48e52f7c57e99e1e1bf54c8760d4f082cd1c89d", "source": "security-advisories@github.com"}, {"url": "https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Rack session middleware prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests. When using the `Rack::Session::Pool` middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. Version 2.2.14 contains a patch for the issue. Some other mitigations are available. Either ensure the application invalidates sessions atomically by marking them as logged out e.g., using a `logged_out` flag, instead of deleting them, and check this flag on every request to prevent reuse; or implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began."}, {"lang": "es", "value": "Rack es una interfaz modular de servidor web Ruby. Antes de la versi\u00f3n 2.2.14, al usar el middleware `Rack::Session::Pool`, las solicitudes simult\u00e1neas de Rack pod\u00edan restaurar una sesi\u00f3n de Rack eliminada, lo que permit\u00eda al usuario no autenticado ocuparla. El middleware de sesi\u00f3n de Rack prepara la sesi\u00f3n al inicio de la solicitud y la guarda en el almac\u00e9n con los posibles cambios aplicados por la aplicaci\u00f3n host de Rack. De esta forma, la sesi\u00f3n se convierte en objeto de condiciones de ejecuci\u00f3n, generalmente, sobre solicitudes concurrentes de Rack. Al usar el middleware `Rack::Session::Pool`, y siempre que el atacante pueda obtener una cookie de sesi\u00f3n (un problema ya importante), la sesi\u00f3n puede restaurarse si el atacante puede activar una solicitud de larga duraci\u00f3n (dentro de la misma sesi\u00f3n) junto al cierre de sesi\u00f3n del usuario, para as\u00ed retener el acceso il\u00edcito incluso despu\u00e9s de que el usuario haya intentado cerrar sesi\u00f3n. La versi\u00f3n 2.2.14 incluye un parche para este problema. Hay otras mitigaciones disponibles. Aseg\u00farese de que la aplicaci\u00f3n invalide las sesiones de manera at\u00f3mica marc\u00e1ndolas como desconectadas, por ejemplo, utilizando una bandera `logged_out`, en lugar de eliminarlas, y verifique esta bandera en cada solicitud para evitar la reutilizaci\u00f3n; o implemente un almac\u00e9n de sesiones personalizado que rastree las marcas de tiempo de invalidaci\u00f3n de la sesi\u00f3n y se niegue a aceptar datos de la sesi\u00f3n si la sesi\u00f3n se invalid\u00f3 despu\u00e9s de que comenz\u00f3 la solicitud."}], "lastModified": "2025-05-08T14:39:09.683", "sourceIdentifier": "security-advisories@github.com"}