CVE-2025-27111: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
Summary
Rack::Sendfile can be exploited by crafting input that includes newline characters to manipulate log entries.
Details
The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection.
Impact
This vulnerability can distort log files, obscure attack traces, and complicate security auditing.
Mitigation
- Update to the latest version of Rack, or - Remove usage of Rack::Sendfile.
Other sources
Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/rackto a version that resolves this vulnerability.Fixed in 3.1.11 - Upgrade
Upgrade
rubygems/rackto a version that resolves this vulnerability.Fixed in 3.0.13 - Upgrade
Upgrade
rubygems/rackto a version that resolves this vulnerability.Fixed in 2.2.12 - Upgrade
Upgrade
debian/ruby-rackto a version that resolves this vulnerability.Fixed in 2.1.4-3+deb11u3Fixed in 2.2.13-1~deb12u1Fixed in 3.1.12-1 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 2.2.12 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.0.13 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.11 - Remove
Remove
Rack::Sendfilefrom your environment.Remove usage of the Rack::Sendfile middleware, since it logs unsanitised header values from the X-Sendfile-Type header.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27111?
CVE-2025-27111 has a medium severity level due to the potential for log manipulation via crafted header input.
How do I fix CVE-2025-27111?
To fix CVE-2025-27111, upgrade to Rack version 3.1.11, 3.0.13, or 2.2.12 or later.
What systems are affected by CVE-2025-27111?
CVE-2025-27111 affects versions of Rack prior to 3.1.11, 3.0.13, and is relevant for versions up to 2.2.12.
What is the primary issue with CVE-2025-27111?
The primary issue with CVE-2025-27111 is the logging of unsanitized header values from the X-Sendfile-Type header.
Can CVE-2025-27111 lead to further attacks?
Yes, CVE-2025-27111 can potentially lead to further attacks involving log injection and information disclosure.