CVE-2024-26144 PoC — Possible Sensitive Session Information Leak in Active Storage

Readme

# CVE-2024-26144-test

Requirement:

- Docker compose
- Deno

```sh
$ deno run --allow-run --allow-net check.ts
```

If you want to test CDN, please set the URL in argument.

(Make sure all caches are purged before run!)

```sh
$ deno run --allow-run --allow-net check.ts https://example.com/
```

# Results

If HTTP response contains `Set-Cookie` header...

| Web server                                | Response cached (\*1) | Cache contains Set-Cookie |
| ----------------------------------------- | --------------------- | ------------------------- |
| Nginx + proxy_cache                       | NO                    | -                         |
| Nginx + Passenger                         | YES                   | YES                       |
| Apache + mod_cache                        | YES                   | YES                       |
| HAProxy                                   | YES                   | YES                       |
| Cloudflare (Free plan)                    | NO                    | -                         |
| CloudFront (CachingOptimized)             | YES                   | NO                        |
| CloudFront (UseOriginCacheControlHeaders) | NO                    | -                         |
| Fastly                                    | NO                    | -                         |

\*1 It is the result of whether the cache works for anonymous user. Even if it says `NO`, it may return cache for the request with same cookie.

File Snapshot

Remarks