Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the download_file method of the Decidim::DownloadYourDataController. Before the patch, this method would generate a direct, signed, but permanent URL to an Active Storage blob. This URL, once generated, could be used by anyone, bypassing the application's authentication and authorization checks. The vulnerability is a classic example of Broken Access Control (OWASP A01:2021). The patch mitigates this by introducing a new PrivateDownloadsController. Instead of redirecting to the blob URL directly, the download_file method now redirects to this new controller, passing a temporary token. The PrivateDownloadsController then verifies the token and the user's authorization before serving the file via send_data, ensuring that only the legitimate owner can access the export.
Decidim::DownloadYourDataController.download_filedecidim-core/app/controllers/decidim/download_your_data_controller.rb
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| decidim-core | rubygems | < 0.30.9 | 0.30.9 |
| decidim-core | rubygems | >= 0.31.0.rc1, < 0.31.5 | 0.31.5 |
| decidim-core | rubygems | >= 0.32.0.rc1, < 0.32.0 | 0.32.0 |