Authentication Bypass Vulnerability in rucio-webui
Summary
GHSA-v988-828w-xvf2: Impact rucio-webui installations of the 1.26 release line potentially leak the contents of cookies to other sessions within a wsgi container. Affects rucio-webui versions >= 1.26.0, < 1.26.7. Fixed in 1.26.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rucio-webui package is a component of Rucio, a scientific data management system used by research organizations. It provides a web-based user interface for managing data and resources. The vulnerability affects installations of the 1.26 release line of rucio-webui. It allows for the leakage of authentication tokens to other sessions within a wsgi container, potentially leading to unauthorized access and privilege escalation. The Rucio server and daemons are not affected by this issue.
Vulnerability Detail
The vulnerability in rucio-webui versions 1.26.0 to 1.26.6 allows for the leakage of authentication tokens to other users accessing the web interface within a close timeframe. This occurs due to a flaw in the handling of cookies, which can be accessed by other sessions within the same wsgi container. As a result, an attacker can obtain the leaked authentication token and use it to access the web interface with escalated privileges. This poses a significant security risk as it allows unauthorized access to sensitive data and functionality.
How To Fix
Minimum fixed version
1.26.7
This is the first release that contains the fix.
pip install --upgrade "rucio-webui==1.26.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.26.7 is not immediately feasible, a workaround is to install version 1.25.7 of the webui, as this release line is not affected by the vulnerability. This can be done by specifying the desired version during installation or by manually downgrading the package.
Conclusion
The authentication bypass vulnerability in rucio-webui versions 1.26.0 to 1.26.6 poses a significant security risk by allowing unauthorized access and privilege escalation. Users are advised to upgrade to version 1.26.7 or install version 1.25.7 as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rucio-webui →
FAQ
The vulnerability allows for the leakage of authentication tokens, enabling unauthorized access to the web interface and potential privilege escalation.
No, the vulnerability is isolated to the webui component. The Rucio server and daemons are not affected.
The recommended fix is to upgrade to version 1.26.7 of rucio-webui, which includes a patch for the authentication bypass issue.
Yes, if immediate upgrading is not possible, installing version 1.25.7 of the webui is a viable workaround as it is not affected by the vulnerability.
Additional details about the vulnerability can be found in the GitHub issue: https://github.com/rucio/rucio/issues/4928
References
Related vulnerabilities
Recent vulnerabilities recorded for rucio-webui.
