CVE-2024-26144
MEDIUMRails 5.2.0-6.1.7.6 - Sensitive Session Information Leak via Active Storage Blob Set-Cookie Header
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-26144. PoCs published by gmo-ierae, usutani.
AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2024-26144, which tests for cache poisoning vulnerabilities in various web servers and CDNs. The PoC uses a Deno script to check if cached responses incorrectly include Set-Cookie headers, potentially leaking sensitive session data.
Description
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.
Exploits (2)
This repository contains a proof-of-concept for CVE-2024-26144, which tests for cache poisoning vulnerabilities in various web servers and CDNs. The PoC uses a Deno script to check if cached responses incorrectly include Set-Cookie headers, potentially leaking sensitive session data.
This repository appears to be a stub or study project for Turbolinks, lacking exploit code or PoC for CVE-2024-26144. It contains a basic Rails application structure with Turbolinks integration but no offensive techniques.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N