CVE-2024-26144

Name of the Vulnerable Software and Affected Versions Rails versions 5.2.0 through 7.0.8.0 Rails versions 6.1.0 through 6.1.7.6

Description The issue is related to a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. This may cause users to share sessions, potentially allowing an attacker to receive a user's session or vice versa.

Recommendations For Rails versions 5.2.0 through 7.0.8.0, upgrade to version 7.0.8.1 or configure caching proxies not to cache the Set-Cookie headers. For Rails versions 6.1.0 through 6.1.7.6, upgrade to version 6.1.7.7 or configure caching proxies not to cache the Set-Cookie headers. As a temporary workaround, consider configuring caching proxies to exclude the Set-Cookie headers from being cached.