CVE-2024-25126: Rack ReDos in content type parsing (2nd degree polynomial)
Summary
ruby module Rack class MediaType SPLITPATTERN = %r{\s[;,]\s} The above regexp is subject to ReDos. 50K blank characters as a prefix to the header will take over 10s to split.
PoC
A simple HTTP request with lots of blank characters in the content-type header:
ruby request["Content-Type"] = (" " 50000) + "a,"
Impact
It's a very easy to craft ReDoS. Like all ReDoS the impact is debatable.
Other sources
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
— Launchpad
There is a possible denial of service vulnerability in the content type parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2024-25126.
Versions Affected: >= 0.4 Not affected: < 0.4 Fixed Versions: 3.0.9.1, 2.2.8.1 Impact
There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1
There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.
Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25126?
CVE-2024-25126 has been classified as a medium severity vulnerability due to its potential to lead to Denial of Service attacks through ReDoS.
How do I fix CVE-2024-25126?
To fix CVE-2024-25126, update the 'rack' package to version 2.2.8.1 or 3.0.9.1, depending on your current version.
Which versions of Rack are affected by CVE-2024-25126?
The vulnerable versions of Rack range from 0.4 up to 2.2.8.1 and from 3.0.0 up to 3.0.9.1.
What kind of attack does CVE-2024-25126 enable?
CVE-2024-25126 enables ReDoS (Regular Expression Denial of Service) attacks, which can significantly delay response times.
Are there specific platforms affected by CVE-2024-25126?
Yes, CVE-2024-25126 affects installations of Rack on RubyGems, Red Hat, and Debian packages.