GHSA-356j-hg45-x525

Suggest an improvement
Source
https://github.com/advisories/GHSA-356j-hg45-x525
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-356j-hg45-x525/GHSA-356j-hg45-x525.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-356j-hg45-x525
Aliases
  • CVE-2023-50448
Published
2023-12-15T23:44:34Z
Modified
2024-02-16T08:04:03.834015Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Potential CSV export data leak
Details

Impact

In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user.

The bug affects the functionality to export data as CSV files, and was caused by a variable holding the collection to be exported being shared across threads and not properly synchronized.

The attacker would need access to the same ActiveAdmin application as the victim, and could exploit the issue by timing their request immediately before when they know someone else will request a CSV (e.g. via phishing) or request CSVs frequently and hope someone else makes a concurrent request.

Patches

Versions 2.12.0 and above fixed the problem by completely removing the shared state.

Database specific 
{
    "nvd_published_at": "2023-12-28T23:15:43Z",
    "cwe_ids": [
        "CWE-1236",
        "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-15T23:44:34Z"
}
References

Affected packages

RubyGems / activeadmin

Package

Name
activeadmin
Purl
pkg:gem/activeadmin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.12.0

Affected versions

0.*

0.1.0
0.1.1
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0.pre
0.5.0.pre1
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6

1.*

1.0.0.pre1
1.0.0.pre2
1.0.0.pre3
1.0.0.pre4
1.0.0.pre5
1.0.0
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3

2.*

2.0.0.rc1
2.0.0.rc2
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.8.1
2.9.0
2.10.0
2.10.1
2.11.0
2.11.1
2.11.2