Internet Bug Bounty · Report #3082917

Possible Sensitive Session Information Leak in Active Storage

Validstatus

highseverity

$4,323bounty

82upvotes

27 Apr 2025disclosed

Summary

Possible Sensitive Session Information Leak in Active Storage

There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak.

This vulnerability has been assigned the CVE identifier CVE-2024-26144.

Versions Affected: >= 5.2.0, < 7.1.0 Not affected: < 5.2.0, > 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7

How it was found

Original report: https://hackerone.com/reports/2140554 Advisory: https://github.com/rails/rails/security/advisories/GHSA-8h22-8cf7-hq6g

Impact

Active Storage, when serving files (blobs), incorrectly sends the Set-Cookie header containing the user's session cookie along with a Cache-Control: public header. Some certain caching proxies may cache this response, including the Set-Cookie header. This allows unrelated users accessing the cached content to obtain the original user's session cookie.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original