From 40cc1876a802ec32dbd4785895452cf6cfbb5102 Mon Sep 17 00:00:00 2001 From: Scott Gibson Date: Sat, 25 Jul 2026 11:32:41 -0400 Subject: [PATCH 1/2] Add advisory for where_is_waldo (GHSA-r766-3v88-pfcf, fixed in 0.1.6) --- gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml | 26 +++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml diff --git a/gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml b/gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml new file mode 100644 index 0000000000..df7e36857b --- /dev/null +++ b/gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml @@ -0,0 +1,26 @@ +--- +gem: where_is_waldo +ghsa: r766-3v88-pfcf +url: https://github.com/byscott-io/where_is_waldo/security/advisories/GHSA-r766-3v88-pfcf +title: >- + where_is_waldo authenticates ActionCable connections from a client-supplied + subject_id when no authenticate_proc is configured +date: 2026-07-25 +description: | + WhereIsWaldo::ApplicationCable::Connection (the gem's built-in ActionCable + connection) authenticated the connection from `request.params[:subject_id]` + whenever no `authenticate_proc` was configured. Because request params are + client-controlled, a client could connect with `?subject_id=` and be + authenticated as that subject, enabling impersonation and cross-account + presence-roster disclosure (authentication bypass by spoofing, CWE-290). + + Only applications that mount the built-in connection without configuring + `authenticate_proc` are affected; applications that supply their own + authenticated ActionCable connection (e.g. deriving current_user from a + verified JWT) or configure `authenticate_proc` are not. + + Fixed in 0.1.6: the params path is permitted only in local development/test; + in production the connection fails closed unless an authenticated source + establishes the subject. +patched_versions: + - ">= 0.1.6" From 103d68b4c700bf230ef3e4ed2178fca1dc40d812 Mon Sep 17 00:00:00 2001 From: Scott Gibson Date: Sat, 25 Jul 2026 12:12:19 -0400 Subject: [PATCH 2/2] where_is_waldo: add notes re: pending CVE (review feedback) --- gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml b/gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml index df7e36857b..571b6a24a8 100644 --- a/gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml +++ b/gems/where_is_waldo/GHSA-r766-3v88-pfcf.yml @@ -24,3 +24,5 @@ description: | establishes the subject. patched_versions: - ">= 0.1.6" +notes: | + - A CVE has been requested for this GHSA and can be added once assigned.