Client side sessions should not allow unencrypted storage
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-312.
Summary
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with access to the cookies. For this to be a vulnerability, some kind of sensitive data would need to be stored in the session and the session cookie would have to leak. For example, the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allowed capture of the cookies. As of version 1.9.0, a securely randomly generated signing key is used. As a workaround, one may supply an encryption key, as per the documentation recommendation.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ratpack | ratpack | before 1.9.0 | 1.9.0 | Patch available | CNA |
| — | io.ratpack:ratpack-session (Maven) | before 1.9.0 | 1.9.0 | Patch available | GHSA-phj8-4cq3-794g |
- ratpack Vendorratpack Affected before 1.9.0 Fixed in 1.9.0 Patch available CNA
- io.ratpack:ratpack-session (Maven) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-phj8-4cq3-794g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ratpack_project:ratpack:*:*:*:*:*:*:*:* | before 1.9.0 | Vulnerable | Ratpack Project |
- cpe:2.3:a:ratpack_project:ratpack:*:*:*:*:*:*:*:* Versions before 1.9.0 Vulnerable ·Ratpack Project
Remediation
- Fix · CNA ratpack (ratpack) Fixed in 1.9.0
- Fix · GHSA-phj8-4cq3-794g io.ratpack:ratpack-session (Maven) Fixed in 1.9.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29481
- 2026-10-03 Alias added: GHSA-phj8-4cq3-794g
References
More ratpack vulnerabilities
- TI-2021-10198 Remote Code Execution Vulnerability in Session Storage CVSS 3.1CRITICAL 9.9
- TI-2021-10192 Cached redirect poisoning via X-Forwarded-Host header CVSS 3.1HIGH 7.0
- TI-2019-08035 Cross-site scripting in io.ratpack:ratpack-core CVSS 3.1MEDIUM 6.1
- TI-2021-10193 Default client side session signing key is highly predictable CVSS 3.1MEDIUM 4.4
Sources
- CVE-2021-29481 · CVE Program
- CVE-2021-29481 · NVD
- FIRST EPSS
- GHSA-phj8-4cq3-794g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences