CVE-2022-23633— Exposure of sensitive information in Action Pack

Quick assessment

Copy summary Copy citation

Affected

rails rails

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Rails Action Pack是美国Rails社区的一个web框架。提供了路由机制（将请求URL映射到动作），定义实现动作的控制器以及通过渲染视图（各种格式的模板）生成响应的机制。 Action Pack 存在信息泄露漏洞，该漏洞源于在某些情况下，反应机构不会关闭，如果响应没有收到close 的通知，ActionDispatch::Executor 将不知道为下一个请求重置线程本地状态。攻击者可利用该漏洞导致数据泄露给后续请求。

CVE-2022-23633 affects rails rails. No confirmed in-the-wild exploitation; assess based on exposure. Rails Action Pack是美国Rails社区的一个web框架。提供了路由机制（将请求URL映射到动作），定义实现动作的控制器以及通过渲染视图（各种格式的模板）生成响应的机制。 Action Pack 存在信息泄露漏洞，该漏洞源于在某些情况下，反应机构不会关闭，如果响应没有收到close 的通知，ActionDispatch::Executor 将不 CVE-2022-23633 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2022-23633

I. Basic Information for CVE-2022-23633

Affected Products

II. Public POCs for CVE-2022-23633

III. Intelligence Information for CVE-2022-23633

Patches & Fixes for CVE-2022-23633 (1)

• Fix reloader to work with new Executor signature · rails/rails@f9a2ad0 · GitHub

Vendor Advisories for CVE-2022-23633 (2)

• https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9
• https://security.netapp.com/advisory/ntap-20240119-0013/

Mailing List Discussions for CVE-2022-23633 (2)

• https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html mailing-list
• http://www.openwall.com/lists/oss-security/2022/02/11/5 mailing-list

• https://www.cve.org/CVERecord?id=CVE-2022-23633

IV. Related Vulnerabilities

V. Comments for CVE-2022-23633