Timing Attack Affecting railties package, versions <5.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-RAILTIES-20454
- published 25 Dec 2017
- disclosed 2 Oct 2015
- credit Unknown
How to fix?
Upgrade railties to version 5.0.0.beta1 or higher.
Overview
railties is Rails internals: application bootup, plugins, generators, and rake tasks.
Affected versions of the package are vulnerable to Timing Attack via the runtime header, which returns the amount of time spent on the server. You can read more about timing attacks (using Node.js as an example) on the Snyk blog: https://snyk.io/blog/node-js-timing-attack-ccc-ctf/
References
CVSS Scores
version 3.1