CVE-2025-66803
📋 TL;DR
A race condition in Hotwired Turbo's turbo-frame element handler allows logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays or by physically proximate attackers on shared computers. Affects applications using Hotwired Turbo for dynamic page updates.
💻 Affected Systems
- Hotwired Turbo
📦 What is this software?
Turbo by Hotwired
⚠️ Risk & Real-World Impact
Worst Case
Attackers maintain unauthorized access to user sessions after logout, potentially accessing sensitive data or performing actions as the logged-out user.
Likely Case
Session persistence after logout on shared computers or in environments with network manipulation, leading to unauthorized access.
If Mitigated
Minimal impact with proper session management controls and timely patching.
🎯 Exploit Status
Exploitation requires timing manipulation and access to the user's session context.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.x and later
Vendor Advisory: https://github.com/hotwired/turbo/security/advisories/GHSA-qppm-g56g-fpvp
Restart Required: Yes
Instructions:
1. Update Hotwired Turbo to version 8.0.x or later. 2. Restart the application server. 3. Verify the fix by testing logout functionality.
🔧 Temporary Workarounds
Disable turbo-frame for logout operations
allAvoid using turbo-frame elements for logout actions to prevent the race condition.
Modify application code to use standard form submissions or links for logout instead of turbo-frame.
🧯 If You Can't Patch
- Implement server-side session invalidation on logout to ensure cookies are properly cleared.
- Use short session timeouts and enforce re-authentication for sensitive operations.
🔍 How to Verify
Check if Vulnerable:
Check the Turbo version in your package.json or Gemfile. If version is below 8.0.x and turbo-frame is used for logout, the system is vulnerable.Check Version:
For npm: npm list @hotwired/turbo. For Ruby: bundle show turbo-rails.Verify Fix Applied:
After updating to Turbo 8.0.x or later, test logout functionality to ensure sessions are properly terminated and cookies are not reapplied.📡 Detection & Monitoring
Log Indicators:
- Multiple session cookie reapplications after logout requests
- Unusual timing delays in frame responses
Network Indicators:
- Delayed HTTP responses to turbo-frame requests coinciding with logout operations
SIEM Query:
Search for logout events followed by session cookie resets within a short time window.