Listen to this Post
This vulnerability exploits a race condition within the Turbo Frames component of the Hotwire stack. When a Turbo Frame initiates an HTTP request (e.g., loading content) and, while that request is still in-flight, a session-modifying operation occurs on the server (like user logout), the delayed response for the original frame request can cause issues. The browser automatically processes any `Set-Cookie` headers present in the HTTP response. If the delayed response contains a `Set-Cookie` header reflecting the old, pre-modification session state (because the request was made before logout), the browser will overwrite the current, invalidated session cookie with this stale value. This effectively restores the previous authenticated session after the user intended to log out. The condition can happen naturally on slow networks but could be weaponized by an attacker capable of delaying specific HTTP responses to force this cookie restoration.
Platform: Turbo (Ruby on Rails)
Version: <= 8.0.20
Vulnerability: Race Condition
Severity: Medium
date: 2024-01-15
Prediction: Patched in 8.0.21
What Undercode Say:
Check current Turbo version in Gemfile.lock grep -A2 -B2 "turbo-rails" Gemfile.lock Simulate a slow network delay for Turbo Frame requests (testing) Use browser dev tools to throttle network to "Slow 3G" Example of a Turbo Frame tag in HTML <turbo-frame id="user_data" src="/profile"> <!-- Content loads here --> </turbo-frame>
How Exploit:
- Attacker lures user to page with active Turbo Frame.
2. User initiates logout (invalidates session server-side).
3. Attacker delays the Turbo Frame response.
4. Delayed response delivers old `Set-Cookie`.
5. Browser restores stale session cookie.
6. User’s session is reverted.
Protection from this CVE
- Upgrade to Turbo >= 8.0.21.
- Implement server-side session storage (e.g., Redis).
- Disable Turbo Frames on logout flows.
- Use `fetch()` with `credentials: ‘same-origin’` cautiously.
Impact:
- Session reversion after logout.
- Unintended auth state restoration.
- Limited to cookie-based sessions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
