Executive brief
rails-session-decoder is a Node.js library used to decode session data from Ruby on Rails applications. The library fails to validate the cryptographic signature (MAC) on encrypted cookies, allowing an attacker with access to encrypted session data to decrypt and read sensitive information such as user credentials or session tokens without needing the correct cryptographic keys. This creates a significant security risk for applications relying on this decoder for session management.
Technical details
The vulnerability is a cryptographic validation bypass in rails-session-decoder, stemming from missing verification of the Message Authentication Code (MAC) that protects the integrity and authenticity of encrypted cookies. The root cause is the library's failure to validate the MAC appended to ciphertext before decryption, allowing an attacker who possesses an encrypted session cookie to decrypt it without the legitimate authentication key. The attack requires only network access to capture encrypted session data; no prior authentication is required. An attacker can exploit this to extract sensitive information stored in encrypted sessions, including authentication tokens, user identifiers, and other session-bound data. As of the advisory date (September 2020), no patch is available; the maintainers recommended using an alternative library until a fix is released.
Affected products
- npm rails-session-decoder
Timeline
- 2020-09-02: disclosed