rack@1.6.4

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the Rack::Static component. An attacker can bypass intended security headers by requesting static files using URL-encoded paths, causing the headers not to be applied as expected.

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Permissive Regular Expression in the Rack::Directory component when the configured root path is interpolated directly into a regular expression without escaping. An attacker can obtain sensitive filesystem path information by supplying a root path containing regex metacharacters, which causes the directory listing to reveal unintended details in the HTML output.

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Denial of Service (DoS) through the get_byte_ranges function. An attacker can exhaust CPU, memory, I/O, and bandwidth resources by sending requests with numerous small overlapping byte ranges in the HTTP Range header.

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Permissive Regular Expression in the map_accel_path component. An attacker can read arbitrary files by injecting specially crafted values into the HTTP_X_ACCEL_MAPPING header, which are then interpolated into a regular expression and used to rewrite file paths for X-Accel-Redirect responses in nginx.

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the Rack::Utils.select_best_encoding component. An attacker can cause excessive CPU consumption by sending a specially crafted Accept-Encoding header containing multiple wildcard entries.

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Partial String Comparison in the Rack::Static component when URL prefix matching is used to determine if a request should be served as a static file. An attacker can access unintended files by crafting request paths that share the configured prefix, potentially leading to unauthorized disclosure of sensitive information.

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via the Rack::Files#fail component. An attacker can cause incorrect HTTP response framing and potential response desynchronization by requesting a non-existent path containing percent-encoded UTF-8 characters, which leads to a mismatch between the declared and actual Content-Length values.

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Interpretation Conflict in the Rack::Multipart::Parser component. An attacker can cause the application to interpret multipart form data differently from upstream proxies or WAFs by sending requests with multiple boundary parameters in the Content-Type header. This can allow malicious form fields or file uploads to bypass upstream inspection and be processed by the application.

Note:

This is only exploitable if an upstream proxy, WAF, or intermediary interprets the first boundary parameter while the application parses the last one.

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in Rack::Directory, which automatically provides links to filenames on the filesystem. An attacker who can write files on the target system can cause the execution of JavaScript in the context of the hosting application by naming a file with an executable scheme like javascript: as part of its name, and convincing a user to click the malicious entry in the generated directory listing.

Upgrade rack to version 2.2.22, 3.1.20, 3.2.5 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Exposure of Information Through Directory Listing in Rack::Directory, which checks for presence in the root directory only by left-side string comparison. An attacker can list directories outside the intended root if the prefix of the target directory is exactly the name of the root directory. E.g. www_backup is exposed when www is intended.

Upgrade rack to version 2.2.22, 3.1.20, 3.2.5 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Rack::Request#POST process. An attacker can exhaust system memory by sending large application/x-www-form-urlencoded request bodies, causing application slowdowns or termination by the operating system due to out-of-memory conditions. This occurs before any parameter parsing or configured parsing limits are enforced, allowing unbounded memory allocation proportional to the request size and concurrency.

Upgrade rack to version 3.2.3, 3.1.18, 2.2.20 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Information Exposure in the Rack::Sendfile() when running behind a proxy that supports x-sendfile headers. An attacker can access internal endpoints intended to be protected by sending specially crafted x-sendfile-type or x-accel-mapping headers, causing the proxy to reissue internal requests that bypass access controls. This is only exploitable if the application uses Rack::Sendfile with a proxy supporting x-accel-redirect, the proxy does not always set or remove the x-sendfile-type and x-accel-mapping headers, and the application exposes an endpoint that returns a body responding to .to_path.

Upgrade rack to version 2.2.20, 3.1.18, 3.2.3 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Rack::Multipart::Parser. An attacker can cause excessive memory consumption and potential process termination by sending multipart/form-data requests with a large preamble, leading to significant memory spikes and possible denial of service. The impact increases with higher allowed request sizes and concurrency.

Upgrade rack to version 2.2.19, 3.1.17, 3.2.2 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Rack::Multipart::Parser. An attacker can exhaust system memory by sending multipart form submissions with excessively large non-file fields, leading to process crashes or degraded performance due to memory exhaustion and increased garbage collection overhead.

Upgrade rack to version 2.2.19, 3.1.17, 3.2.2 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Rack::Multipart::Parser. An attacker can exhaust system memory and cause process termination or severe slowdown by sending multipart requests with headers that never terminate, leading to unbounded memory allocation.

Upgrade rack to version 2.2.19, 3.1.17, 3.2.2 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to params_limit only being enforced for parameters separated by &, while still splitting on both & and ; in the QueryParser. An attacker can exhaust system resources and cause service disruption by submitting a large number of parameters separated by semicolons, bypassing the intended parameter count limit.

Note:

This is only exploitable if the QueryParser is used directly with its default configuration (no explicit delimiter).

Upgrade rack to version 2.2.18 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Race Condition in Rack::Session::Pool middleware, which allows an attacker to restore and use a deleted session. The attacker must be in possession of a valid session cookie and the attack must be timed to coincide with a disconnection from the long-running session by another user.

Upgrade rack to version 2.2.14 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Rack::QueryParser. An attacker can exhaust memory and CPU by sending HTTP requests containing an excessively large number of &-separated query parameters.

Upgrade rack to version 2.2.14, 3.0.16, 3.1.14 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Relative Path Traversal in the can_serve() function in Rack::Static that enables local file inclusion. An attacker who knows the exact path to any file in the root: file directory can access it by supplying a path traversing pathname.

Upgrade rack to version 2.2.13, 3.0.14, 3.1.12 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the Rack::Sendfile middleware which logs values from the X-Sendfile-Type header. An attacker can inject messages into logs by including escape sequences such as newline characters in sent headers.

Upgrade rack to version 2.2.12, 3.0.13, 3.1.11 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs through the Rack::CommonLogger process. An attacker can manipulate log entries by crafting input that includes newline characters to insert fraudulent entries or obscure real activity.

Upgrade rack to version 2.2.11, 3.0.12, 3.1.10 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Denial of Service (DoS) in handling of the Range request header. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. This issue is present when the Rack::File middleware or the Rack::Utils.byte_ranges methods are used (which includes applications built with Rails).

Upgrade rack to version 2.2.8.1, 3.0.9.1 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when parsing Content-Type data in media_type.rb, causing a slow-down in parsing performance. Code using any of the following may be vulnerable: request.media_type, request.media_type_params, Rack::MediaType.type(content_type)

Upgrade rack to version 2.2.8.1, 3.0.9.1 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the build_nested_query() function, used when parsing Accept and Forwarded headers. This can cause parsing performance to slow down.

Upgrade rack to version 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the Multipart MIME parsing functionality in parser.rb, which doesn't limit the number of total parts that can be uploaded. Exploiting this vulnerability is possible via a carefully crafted request, which might result in multipart parsing taking longer than expected.

Upgrade rack to version 2.0.9.3, 2.1.4.3, 2.2.6.3, 3.0.4.2 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the get_byte_ranges() range header parsing function in utils.rb.

NOTE: Patches have been released to address this issue: 2-0-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch, 2-1-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch, 2-2-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch, 3-0-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch

Upgrade rack to version 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.4.1 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the multipart parsing component. Exploiting this vulnerability is possible when carefully crafted multipart POST requests cause Rack's multipart parser to take much longer than expected.

Notes:

Impacted code will use Rack's multipart parser to parse multipart posts. This includes directly using the multipart parser like this:

params = Rack::Multipart.parse_multipart(env)

It also includes reading POST data from a Rack request object like this:

p request.POST # read POST data 

p request.params # reads both query params and POST data

Upgrade rack to version 2.0.9.1, 2.1.4.1, 2.2.3.1 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Arbitrary Code Injection. There is a possible shell-escape sequence injection vulnerability in Rack's Lint and CommonLogger components. Carefully crafted requests can cause shell escape sequences to be written to the terminal via Rack's Lint middleware and CommonLogger middleware. These escape sequences can be leveraged to possibly execute commands in the victim's terminal.

Notes:

Impacted applications will have either of these middleware installed, and vulnerable apps may have something like this:use Rack::Lint or use Rack::CommonLogger.

Upgrade rack to version 2.0.9.1, 2.1.4.1, 2.2.3.1 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

PoC

GET /?q=legitimate&utm_content=1;q=malicious HTTP/1.1

Host: somesite.com

Upgrade-Insecure-Requests: 1		

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,imag e/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate			

Accept-Language: en-US,en;q=0.9 Connection: close			

The server sees 3 parameters here: q, utm_content and then q again. On the other hand, the proxy considers this full string: 1;q=malicious as the value of utm_content, which is why the cache key would only contain somesite.com/?q=legitimate.

Upgrade rack to version 3.0.0.beta1 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). It is possible to forge a secure or host-only cookie prefix in Rack using an arbitrary cookie write by using URL encoding (percent-encoding) on the name of the cookie. This could result in an application that is dependent on this prefix to determine if a cookie is safe to process being manipulated into processing an insecure or cross-origin request.

Upgrade rack to version 2.1.4, 2.2.3 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Directory Traversal. If certain directories exist in a directory that is managed by Rack::Directory, an attacker could, using this vulnerability, read the contents of files on the server that were outside of the root specified in the Rack::Directory initializer.

Upgrade rack to version 2.1.3 or higher.

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Information Exposure. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.

Upgrade rack to version 1.6.12, 2.0.8 or higher.