-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rack-session | rubygems | >= 2.0.0, < 2.1.1 | 2.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability described is a race condition in Rack::Session::Pool where a deleted session can be restored by a concurrent request. The provided patch (commit c28c4a8c1861d814e09f2ae48264ac4c40be2d3b) modifies two key methods: write_session and delete_session in lib/rack/session/pool.rb.
The core of the vulnerability lies in the write_session method. Before the patch, this method did not check if the session it was about to write still existed or was valid. If a session was deleted by one request, a concurrent, long-running request (which had loaded the session data before deletion) could subsequently call write_session and successfully write its stale data, thus restoring the deleted session. The patch fixes this by adding a crucial check: return false unless get_session_with_fallback(session_id). This line ensures that the session is still considered valid before any data is written to it.
Therefore, Rack::Session::Pool#write_session is identified as the vulnerable function because it contained the flaw (the missing check) that allowed the session restoration to occur. While the delete_session method was also modified to improve the robustness of session handling (by ensuring a new, empty session is stored when a session is renewed after deletion, rather than just generating a SID), the actual act of incorrectly restoring the session was performed by the write_session method in its vulnerable state.
Ongoing coverage of React2Shell