Denial of Service (DoS) Affecting unpoly-rails package, versions <2.7.2.2

Affected versions of this package are vulnerable to Denial of Service (DoS) when echoing the request URL as an X-Up-Location response header. By making a request with exceedingly long URLs (paths or query string), an attacker can cause unpoly-rails to write a exceedingly large response header. If the response header is too large to be parsed by a load balancer downstream of the Rails application, it may cause the load balancer to remove the upstream from a load balancing group. This causes that application instance to become unavailable until a configured timeout is reached or until an active healthcheck succeeds.

If users cannot upgrade to a fixed release, several workarounds are available:

• Configure the load balancer to use active health checks, e.g. by periodically requesting a route with a known response that indicates healthiness.

• Configure the load balancer so the maximum size of response headers is at least twice the maximum size of a URL.

• Instead of changing the server configuration users may also configure your Rails application to delete redundant X-Up-Location headers set by unpoly-rails:

  class ApplicationController < ActionController::Base
  
    after_action :remove_redundant_up_location_header
    private
    def remove_redundant_up_location_header
      if request.original_url == response.headers['X-Up-Location']
        response.headers.delete('X-Up-Location')
      end
    end
  end
  

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

• GitHub Commit