What’s Vulnerable › Vulnerabilities
CVE-2024-26144: Possible Sensitive Session Information Leak in Active Storage
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-02-27 · updated 2026-06-17
- Weakness: CWE-200
Description
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.
Affected products
- Ruby on Rails: from 5.2.0 before 6.1.7.7; from 7.0.0 before 7.1.0 — fixed in 6.1.7.7, 7.1.0
- Rubygems Activestorage: from 5.2.0 before 6.1.7.7; from 7.0.0 before 7.0.8.1; 5.2.0, 5.2.1, 5.2.1.1, 5.2.1.rc1, 5.2.2, 5.2.2.1 (+103) — fixed in 6.1.7.7, 7.0.8.1
How to fix
Upgrade to a fixed version: Ruby on Rails 6.1.7.7, 7.1.0; Rubygems Activestorage 6.1.7.7, 7.0.8.1. Check the vendor advisory for mitigations.
References
- https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945
- https://github.com/rails/rails/commit/723f54566023e91060a67b03353e7c03e7436433
- https://github.com/rails/rails/commit/78fe149509fac5b05e54187aaaef216fbb5fd0d3
- https://github.com/rails/rails/security/advisories/GHSA-8h22-8cf7-hq6g
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2024-26144.yml
- https://security.netapp.com/advisory/ntap-20240510-0013/
- https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945
- https://github.com/rails/rails/commit/723f54566023e91060a67b03353e7c03e7436433
- https://github.com/rails/rails/commit/78fe149509fac5b05e54187aaaef216fbb5fd0d3
- https://github.com/rails/rails/security/advisories/GHSA-8h22-8cf7-hq6g
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2024-26144.yml
- https://security.netapp.com/advisory/ntap-20240510-0013/
Get alerted when CVE-2024-26144 or the next vulnerability affects your stack