Default client side session signing key is highly predictable
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used (which is recommended, but is not on by default), the session data could be tampered with by someone with the ability to write cookies. The default configuration is unsuitable for production use as an application restart renders all sessions invalid and is not multi-host compatible, but its use is not actively prevented. As of Ratpack 1.9.0, the default value is a securely randomly generated value, generated at application startup time. As a workaround, supply an alternative signing key, as per the documentation's recommendation.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ratpack | ratpack | before 1.9.0 | 1.9.0 | Patch available | CNA |
| — | io.ratpack:ratpack-session (Maven) | before 1.9.0 | 1.9.0 | Patch available | GHSA-2cc5-23r7-vc4v |
- ratpack Vendorratpack Affected before 1.9.0 Fixed in 1.9.0 Patch available CNA
- io.ratpack:ratpack-session (Maven) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-2cc5-23r7-vc4v
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ratpack_project:ratpack:*:*:*:*:*:*:*:* | before 1.9.0 | Vulnerable | Ratpack Project |
- cpe:2.3:a:ratpack_project:ratpack:*:*:*:*:*:*:*:* Versions before 1.9.0 Vulnerable ·Ratpack Project
Remediation
- Fix · CNA ratpack (ratpack) Fixed in 1.9.0
- Fix · GHSA-2cc5-23r7-vc4v io.ratpack:ratpack-session (Maven) Fixed in 1.9.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29480
- 2026-10-03 Alias added: GHSA-2cc5-23r7-vc4v
References
Advisory 3
More ratpack vulnerabilities
- TI-2021-10198 Remote Code Execution Vulnerability in Session Storage CVSS 3.1CRITICAL 9.9
- TI-2021-10194 Client side sessions should not allow unencrypted storage CVSS 3.1HIGH 7.5
- TI-2021-10192 Cached redirect poisoning via X-Forwarded-Host header CVSS 3.1HIGH 7.0
- TI-2019-08035 Cross-site scripting in io.ratpack:ratpack-core CVSS 3.1MEDIUM 6.1
Sources
- CVE-2021-29480 · CVE Program
- CVE-2021-29480 · NVD
- FIRST EPSS
- GHSA-2cc5-23r7-vc4v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences