Lucene search

K
rubygemsRubySecRUBY:MECHANIZE-2022-31033
HistoryJun 08, 2022 - 9:00 p.m.

Authorization header leak on port redirect in mechanize

2022-06-0821:00:00
RubySec
rubysec.com
35
mechanize
port redirect
authorization header
vulnerability
cookie sharing

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

0.003 Low

EPSS

Percentile

68.9%

Summary

Mechanize (rubygem) < v2.8.5 leaks the Authorization header after a
redirect to a different port on the same site.

Mitigation

Upgrade to Mechanize v2.8.5 or later.

Notes

See https://curl.se/docs/CVE-2022-27776.html for a similar vulnerability in curl.

Cookies are shared with a server at a different port on the same site, per
https://datatracker.ietf.org/doc/html/rfc6265#section-8.5 which states in part:

> Cookies do not provide isolation by port. If a cookie is readable
> by a service running on one port, the cookie is also readable by a
> service running on another port of the same server. If a cookie is
> writable by a service on one port, the cookie is also writable by a
> service running on another port of the same server. For this
> reason, servers SHOULD NOT both run mutually distrusting services on
> different ports of the same host and use cookies to store security-
> sensitive information.

CPENameOperatorVersion
mechanizelt2.8.5

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

0.003 Low

EPSS

Percentile

68.9%