CVE-2021-29481: Unencrypted storage of client side sessions in io.ratpack:ratpack-session
Summary
CVE-2021-29481: Unencrypted storage of client side sessions. Affects io.ratpack:ratpack-session versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.ratpack:ratpack-session package is a component of the Ratpack framework, which is used for building modern web applications in Java. It provides session management functionality, allowing developers to store and retrieve user-specific data across multiple requests. However, the default configuration of client side sessions in this package results in unencrypted storage of session data. While the data is signed, it can be read by anyone with access to the cookies. This vulnerability can be exploited if sensitive data is stored in the session and the session cookie is leaked.
Vulnerability Detail
The vulnerability arises from the default behavior of storing unencrypted, but signed, data as cookie values. If sensitive information is stored in the session and the session cookie is accessible, the data can be read by unauthorized parties. This could occur if the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allows the capture of cookies. The proposed fix is to change the default behavior to use a randomly generated encryption key, ensuring that sessions do not survive app restarts. Starting from version 1.9.0, a securely randomly generated signing key is used to address this vulnerability.
How To Fix
Minimum fixed version
1.9.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not feasible, a workaround is to supply an encryption key manually, as recommended in the documentation. By providing an encryption key, the session data will be encrypted even with older versions of the package. However, it is strongly advised to update to the latest version to benefit from the default secure behavior.
Conclusion
In conclusion, the io.ratpack:ratpack-session package has a vulnerability that allows unencrypted storage of client side sessions. This can lead to unauthorized access to sensitive session data if the session cookies are compromised. To fix this vulnerability, it is recommended to update the package to version 1.9.0 or later. Alternatively, an encryption key can be manually provided as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.ratpack:ratpack-session →
FAQ
The impact of this vulnerability depends on the presence of sensitive data in the session and the accessibility of the session cookies. If an attacker gains access to the cookies, they can read the unencrypted session data, potentially compromising sensitive information.
While it is not mandatory to provide an encryption key, it is highly recommended. Without an encryption key, the session data is stored in an unencrypted format, making it vulnerable to unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
There are no known exploits for this vulnerability at the moment. However, it is important to address the vulnerability promptly to prevent potential unauthorized access to sensitive session data.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.ratpack:ratpack-session.
