Vulnerability-Lookup

CVE-2024-43791 (GCVE-0-2024-43791)

Vulnerability from cvelistv5 – Published: 2024-08-23 14:39 – Updated: 2024-08-23 18:10

Title

RequestStore has Incorrect Default Permissions

Summary

RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-276 - Incorrect Default Permissions

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/steveklabnik/request_store/sec…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
steveklabnik	request_store	Affected: = 1.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:steveklabnik:request_store:1.3.2:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "request_store",
            "vendor": "steveklabnik",
            "versions": [
              {
                "status": "affected",
                "version": "1.3.2"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43791",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-23T15:12:43.345505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-23T18:10:50.671Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "request_store",
          "vendor": "steveklabnik",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276: Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-23T14:39:10.641Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m"
        }
      ],
      "source": {
        "advisory": "GHSA-frp2-5qfc-7r8m",
        "discovery": "UNKNOWN"
      },
      "title": "RequestStore has Incorrect Default Permissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-43791",
    "datePublished": "2024-08-23T14:39:10.641Z",
    "dateReserved": "2024-08-16T14:20:37.324Z",
    "dateUpdated": "2024-08-23T18:10:50.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43791",
      "date": "2026-05-27",
      "epss": "0.0006",
      "percentile": "0.18794"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43791\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-08-23T15:15:16.830\",\"lastModified\":\"2024-09-12T18:26:31.783\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.\"},{\"lang\":\"es\",\"value\":\"RequestStore proporciona almacenamiento global por solicitud para Rack. Los archivos publicados como parte de request_store 1.3.2 tienen permisos 0666, lo que significa que se pueden escribir en todo el mundo, lo que permite a los usuarios locales ejecutar c\u00f3digo arbitrario. Esta versi\u00f3n se public\u00f3 en 2017, y la mayor\u00eda de entornos de producci\u00f3n no permiten el acceso a usuarios locales, por lo que las posibilidades de que esto sea explotado son muy bajas, dado que la gran mayor\u00eda de usuarios habr\u00e1n actualizado, y los que no, en su caso, no es probable que queden expuestos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:steveklabnik:request_store:1.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B3C3B50-C36E-4263-8E50-2CA2F483BD83\"}]}]}],\"references\":[{\"url\":\"https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43791\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-23T15:12:43.345505Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:steveklabnik:request_store:1.3.2:*:*:*:*:*:*:*\"], \"vendor\": \"steveklabnik\", \"product\": \"request_store\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.3.2\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-23T18:10:44.214Z\"}}], \"cna\": {\"title\": \"RequestStore has Incorrect Default Permissions\", \"source\": {\"advisory\": \"GHSA-frp2-5qfc-7r8m\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"steveklabnik\", \"product\": \"request_store\", \"versions\": [{\"status\": \"affected\", \"version\": \"= 1.3.2\"}]}], \"references\": [{\"url\": \"https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m\", \"name\": \"https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-276\", \"description\": \"CWE-276: Incorrect Default Permissions\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-08-23T14:39:10.641Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43791\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-23T18:10:50.671Z\", \"dateReserved\": \"2024-08-16T14:20:37.324Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-08-23T14:39:10.641Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-43791

Vulnerability from fkie_nvd - Published: 2024-08-23 15:15 - Updated: 2024-09-12 18:26

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m	Third Party Advisory

Impacted products

	Vendor	Product	Version
	steveklabnik	request_store	1.3.2

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:steveklabnik:request_store:1.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B3C3B50-C36E-4263-8E50-2CA2F483BD83",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed."
    },
    {
      "lang": "es",
      "value": "RequestStore proporciona almacenamiento global por solicitud para Rack. Los archivos publicados como parte de request_store 1.3.2 tienen permisos 0666, lo que significa que se pueden escribir en todo el mundo, lo que permite a los usuarios locales ejecutar c\u00f3digo arbitrario. Esta versi\u00f3n se public\u00f3 en 2017, y la mayor\u00eda de entornos de producci\u00f3n no permiten el acceso a usuarios locales, por lo que las posibilidades de que esto sea explotado son muy bajas, dado que la gran mayor\u00eda de usuarios habr\u00e1n actualizado, y los que no, en su caso, no es probable que queden expuestos."
    }
  ],
  "id": "CVE-2024-43791",
  "lastModified": "2024-09-12T18:26:31.783",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-08-23T15:15:16.830",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-FRP2-5QFC-7R8M

Vulnerability from github – Published: 2024-08-23 18:54 – Updated: 2024-08-26 14:12

Summary

request_store has Incorrect Default Permissions

Details

Impact

The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code.

This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.

Patches

I am not aware of any other version of the gem with incorrect permissions, so simply upgrading should fix the issue.

Workarounds

You could chmod the files yourself, I guess.

References

https://cwe.mitre.org/data/definitions/276.html

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

5.9 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "request_store"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.2"
            },
            {
              "fixed": "1.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-43791"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-23T18:54:26Z",
    "nvd_published_at": "2024-08-23T15:15:16Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code.\n\nThis version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.\n\n### Patches\n\nI am not aware of any other version of the gem with incorrect permissions, so simply upgrading should fix the issue.\n\n### Workarounds\n\nYou could chmod the files yourself, I guess.\n\n### References\n\nhttps://cwe.mitre.org/data/definitions/276.html",
  "id": "GHSA-frp2-5qfc-7r8m",
  "modified": "2024-08-26T14:12:40Z",
  "published": "2024-08-23T18:54:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43791"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/request_store/CVE-2024-43791.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/steveklabnik/request_store"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "request_store has Incorrect Default Permissions"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-43791 (GCVE-0-2024-43791)

FKIE_CVE-2024-43791

GHSA-FRP2-5QFC-7R8M

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature