Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zNTZqLWhnNDUteDUyNc4AA323

Potential CSV export data leak

Impact

In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user.

The bug affects the functionality to export data as CSV files, and was caused by a variable holding the collection to be exported being shared across threads and not properly synchronized.

The attacker would need access to the same ActiveAdmin application as the victim, and could exploit the issue by timing their request immediately before when they know someone else will request a CSV (e.g. via phishing) or request CSVs frequently and hope someone else makes a concurrent request.

Patches

Versions 2.12.0 and above fixed the problem by completely removing the shared state.

Permalink: https://github.com/advisories/GHSA-356j-hg45-x525
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zNTZqLWhnNDUteDUyNc4AA323
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 8.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS Percentage: 0.00122
EPSS Percentile: 0.47099

Identifiers: GHSA-356j-hg45-x525, CVE-2023-50448
References:

• https://github.com/activeadmin/activeadmin/security/advisories/GHSA-356j-hg45-x525
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activeadmin/CVE-2023-50448.yml
• https://nvd.nist.gov/vuln/detail/CVE-2023-50448
• https://github.com/activeadmin/activeadmin/pull/7336
• https://github.com/advisories/GHSA-356j-hg45-x525

Repository: https://github.com/activeadmin/activeadmin
Blast Radius: 35.8

Affected Packages