Ruby on Rails 'WEBrick::HTTPRequest' Module HTTP Header Injection Vulnerability
BID:46423
Info
Ruby on Rails 'WEBrick::HTTPRequest' Module HTTP Header Injection Vulnerability
| Bugtraq ID: | 46423 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-3187 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 16 2011 12:00AM |
| Updated: | Oct 17 2011 05:11PM |
| Credit: | Jimmy Bandit |
| Vulnerable: |
Ruby on Rails Ruby on Rails 3.0.5 |
| Not Vulnerable: | |
Discussion
Ruby on Rails 'WEBrick::HTTPRequest' Module HTTP Header Injection Vulnerability
Ruby on Rails is prone to a vulnerability that allows attackers to inject arbitrary content into the 'X-Forwarded-For', 'X-Forwarded-Host' and 'X-Forwarded-Server' HTTP headers because the 'WEBrick::HTTPRequest' module fails to sufficiently sanitize input.
By inserting arbitrary data into the affected HTTP header field, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks.
NOTE: This issue only affects requests sent from clients on the same subnet as the server.
Ruby on Rails 3.0.5 is vulnerable; other versions may also be affected.
Ruby on Rails is prone to a vulnerability that allows attackers to inject arbitrary content into the 'X-Forwarded-For', 'X-Forwarded-Host' and 'X-Forwarded-Server' HTTP headers because the 'WEBrick::HTTPRequest' module fails to sufficiently sanitize input.
By inserting arbitrary data into the affected HTTP header field, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks.
NOTE: This issue only affects requests sent from clients on the same subnet as the server.
Ruby on Rails 3.0.5 is vulnerable; other versions may also be affected.
Exploit / POC
Ruby on Rails 'WEBrick::HTTPRequest' Module HTTP Header Injection Vulnerability
Attackers may use common networking tools to exploit this issue. For some attacks, a vulnerable user may have to follow a malicious URI.
The following exploit code is available:
Attackers may use common networking tools to exploit this issue. For some attacks, a vulnerable user may have to follow a malicious URI.
The following exploit code is available:
Solution / Fix
Ruby on Rails 'WEBrick::HTTPRequest' Module HTTP Header Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].