CVE-2009-2422
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.38% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- rubyonrails/ruby on rails · apple/mac os x · apple/mac os x server
- Source
- cve@mitre.org
References
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlMailing List
- http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3sExploit, Patch
- http://secunia.com/advisories/35702Broken Link, Vendor Advisory
- http://support.apple.com/kb/HT4077Third Party Advisory
- http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digestPatch
- http://www.securityfocus.com/bid/35579Broken Link, Patch, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2009/1802Broken Link, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51528Third Party Advisory, VDB Entry
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlMailing List
- http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3sExploit, Patch
- http://secunia.com/advisories/35702Broken Link, Vendor Advisory
- http://support.apple.com/kb/HT4077Third Party Advisory
- http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digestPatch
- http://www.securityfocus.com/bid/35579Broken Link, Patch, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2009/1802Broken Link, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51528Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.