Vulnerability-Lookup

GHSA-8JHX-9GF4-HHF5

Vulnerability from github – Published: 2019-09-27 20:01 – Updated: 2023-08-29 11:51

Summary

Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

Details

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "consul"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-16377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-09-25T01:09:01Z",
    "nvd_published_at": "2019-09-23T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "With the consul ruby gem before 1.0.3, if a controller checks multiple powers  using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.",
  "id": "GHSA-8jhx-9gf4-hhf5",
  "modified": "2023-08-29T11:51:45Z",
  "published": "2019-09-27T20:01:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16377"
    },
    {
      "type": "WEB",
      "url": "https://github.com/makandra/consul/issues/49"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/makandra/consul"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/c26fbc13435b8be448ad59131428538049d165e4/gems/consul/CVE-2019-16377.yml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/consul/CVE-2019-16377.yml"
    },
    {
      "type": "WEB",
      "url": "https://rubygems.org/gems/consul"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly"
}

CVE-2019-16377 (GCVE-0-2019-16377)

Vulnerability from cvelistv5 – Published: 2019-09-23 15:08 – Updated: 2024-08-05 01:17

Summary

The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

2 references

URL	Tags
https://rubygems.org/gems/consul	x_refsource_MISC
https://github.com/makandra/consul/issues/49	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:17:39.423Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://rubygems.org/gems/consul"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/makandra/consul/issues/49"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-23T15:08:48.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://rubygems.org/gems/consul"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/makandra/consul/issues/49"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-16377",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://rubygems.org/gems/consul",
              "refsource": "MISC",
              "url": "https://rubygems.org/gems/consul"
            },
            {
              "name": "https://github.com/makandra/consul/issues/49",
              "refsource": "MISC",
              "url": "https://github.com/makandra/consul/issues/49"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-16377",
    "datePublished": "2019-09-23T15:08:39.000Z",
    "dateReserved": "2019-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-05T01:17:39.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GSD-2019-16377

Vulnerability from gsd - Updated: 2019-09-23 00:00

Details

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.

Aliases

CVE-2019-16377

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-16377",
    "description": "The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.",
    "id": "GSD-2019-16377"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "consul",
            "purl": "pkg:gem/consul"
          }
        }
      ],
      "aliases": [
        "CVE-2019-16377",
        "GHSA-8jhx-9gf4-hhf5"
      ],
      "details": "With the consul ruby gem before 1.0.3, if a controller checks multiple powers\nusing `:if` or `:except` conditions, these conditions are erroneously applied\nto all power checks in that controller. This can lead to skipped power checks\nand hence unauthenticated access to certain controller actions.\n",
      "id": "GSD-2019-16377",
      "modified": "2019-09-23T00:00:00.000Z",
      "published": "2019-09-23T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/makandra/consul/issues/49"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 9.8,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2019-16377",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://rubygems.org/gems/consul",
            "refsource": "MISC",
            "url": "https://rubygems.org/gems/consul"
          },
          {
            "name": "https://github.com/makandra/consul/issues/49",
            "refsource": "MISC",
            "url": "https://github.com/makandra/consul/issues/49"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2019-16377",
      "cvss_v3": 9.8,
      "date": "2019-09-23",
      "description": "With the consul ruby gem before 1.0.3, if a controller checks multiple powers\nusing `:if` or `:except` conditions, these conditions are erroneously applied\nto all power checks in that controller. This can lead to skipped power checks\nand hence unauthenticated access to certain controller actions.\n",
      "gem": "consul",
      "ghsa": "8jhx-9gf4-hhf5",
      "patched_versions": [
        "\u003e= 1.0.3"
      ],
      "title": "Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly",
      "url": "https://github.com/makandra/consul/issues/49"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=1.0.2",
          "affected_versions": "All before 1.0.3",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2019-09-23",
          "description": "When a controller has multiple power directives, the `:only` and `:except` options of the last directive is applied to all directives. This can lead to unauthenticated access to certain controller actions.",
          "fixed_versions": [
            "1.0.3"
          ],
          "identifier": "CVE-2019-16377",
          "identifiers": [
            "CVE-2019-16377"
          ],
          "not_impacted": "All versions after 1.0.2",
          "package_slug": "gem/consul",
          "pubdate": "2019-09-23",
          "solution": "Upgrade to version 1.0.3 or above.",
          "title": "Incorrect Authorization",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-16377"
          ],
          "uuid": "bba4cca3-28e7-4a8a-8c62-43e801ca547b"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:makandra:consul:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.0.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-16377"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/makandra/consul/issues/49",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/makandra/consul/issues/49"
            },
            {
              "name": "https://rubygems.org/gems/consul",
              "refsource": "MISC",
              "tags": [
                "Product",
                "Third Party Advisory"
              ],
              "url": "https://rubygems.org/gems/consul"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2020-08-24T17:37Z",
      "publishedDate": "2019-09-23T16:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-8JHX-9GF4-HHF5

CVE-2019-16377 (GCVE-0-2019-16377)

GSD-2019-16377

Tags

Sightings

Nomenclature