CVE-2024-43791
📋 TL;DR
CVE-2024-43791 is a local privilege escalation vulnerability in request_store gem version 1.3.2 where world-writable file permissions (0666) allow local users to modify files and potentially execute arbitrary code. This affects Ruby applications using this specific version of the request_store gem for per-request global storage in Rack. The vulnerability primarily impacts systems where local user access exists alongside vulnerable installations.
💻 Affected Systems
- request_store gem
📦 What is this software?
Request Store by Steveklabnik
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains arbitrary code execution with application privileges, potentially leading to full system compromise if application runs with elevated permissions.
Likely Case
Limited impact due to most environments having upgraded or lacking local user access; potential file modification if local access exists.
If Mitigated
No impact if proper access controls prevent local user access to application files or if upgraded version is used.
🎯 Exploit Status
Exploitation requires local user access to modify world-writable files. No known active exploitation in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Any version other than 1.3.2 (versions before or after are not affected)
Vendor Advisory: https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m
Restart Required: Yes
Instructions:
1. Update Gemfile to use request_store version != 1.3.2
2. Run 'bundle update request_store'
3. Restart the Ruby application server
🔧 Temporary Workarounds
Fix file permissions manually
linuxChange permissions of request_store files from 0666 to more restrictive settings
find /path/to/gems -name "*request_store*" -type f -exec chmod 644 {} \;
find /path/to/gems -name "*request_store*" -type d -exec chmod 755 {} \;
🧯 If You Can't Patch
- Restrict local user access to application directories and files
- Implement strict file integrity monitoring for request_store files
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock or run 'bundle show request_store' to see if version 1.3.2 is installedCheck Version:
bundle show request_store | grep -o 'request_store.*'Verify Fix Applied:
Verify request_store version is not 1.3.2 using 'bundle show request_store' or check Gemfile.lock📡 Detection & Monitoring
Log Indicators:
- File permission changes to request_store files
- Unexpected file modifications in gem directories
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
source="file_integrity" AND file_path="*request_store*" AND action="modified"