1 line
4.8 KiB
JSON
1 line
4.8 KiB
JSON
{"schema_version":"1.9.2","id":"GHSA-2j8w-xcrc-x985","published":"2026-11-10T19:11:28Z","modified":"2026-11-10T19:30:04.014924024Z","aliases":["CVE-2026-125109"],"summary":"Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835","details":"## Summary\n\n`Rack::Request#host_with_port`, and therefore `#base_url` and `#url`, return the raw authority string when it fails validation. An attacker-controlled `Host`, `X-Forwarded-Host`, or `Forwarded: host=` value containing characters that are not permitted in an authority is embedded verbatim in URLs generated by the application.\n\nThis completes the fix for CVE-2026-34835 (GHSA-g2pf-xv49-m2h5), which made `#host` and `#hostname` return `nil` for an invalid authority but left this path unchanged.\n\n## Details\n\n`Rack::Request#host_with_port` splits the authority with `split_authority`. When the `AUTHORITY` pattern does not match, no components are returned and `host_with_port` falls back to returning the unvalidated authority string. `base_url` is `\"#{scheme}://#{host_with_port}\"` and `url` appends the full path, so both inherit the raw value.\n\nFor a request with `Host: evil.com/@legit.com`, `host` returns `nil` while `host_with_port` returns `evil.com/@legit.com` and `base_url` returns `http://evil.com/@legit.com`. A valid `Host` together with an invalid `X-Forwarded-Host` produces the same result, because forwarded headers take priority by default.\n\n## Impact\n\nApplications that build absolute URLs, redirects, or origin-dependent checks from `req.url`, `req.base_url`, or `req.host_with_port`, and that do not enforce a host allowlist, may emit URLs containing attacker-chosen characters such as `@`, `/`, `?`, `#`, spaces, or angle brackets. Generated links and `Location` headers can be redirected through userinfo tricks, string-based URL checks can be bypassed, and markup is reflected where the application does not escape the value. For example, `redirect` in Sinatra behind a proxy that forwards `X-Forwarded-Host` emits the raw invalid authority in `Location`.\n\nRails overrides these methods in Action Dispatch and is not expected to be affected. Rack 3.1 and 3.2 are affected. Rack 2.2 did not receive the CVE-2026-34835 change and returns the raw value from every host method.\n\n## Mitigation\n\n* Update to a patched version of Rack, in which `host_with_port` returns `nil` for an invalid authority and `base_url` falls back to the server's own name.\n* Enforce a host allowlist with `Rack::Protection::HostAuthorization`, `config.hosts` in Rails, or at the reverse proxy, and configure the proxy to overwrite `X-Forwarded-Host` and `Forwarded`.\n* Pin the authority with the `rack.request.config` `:authority` key where available.","affected":[{"package":{"name":"rack","ecosystem":"RubyGems","purl":"pkg:gem/rack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}]}],"versions":["3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.2","3.0.3","3.0.4","3.0.4.1","3.0.4.2","3.0.5","3.0.6","3.0.6.1","3.0.7","3.0.8","3.0.9","3.0.9.1","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2j8w-xcrc-x985/GHSA-2j8w-xcrc-x985.json"}},{"package":{"name":"rack","ecosystem":"RubyGems","purl":"pkg:gem/rack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.8"}]}],"versions":["3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2j8w-xcrc-x985/GHSA-2j8w-xcrc-x985.json"}}],"references":[{"type":"WEB","url":"https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125109"},{"type":"WEB","url":"https://github.com/rack/rack/commit/4380381a56dc52556a436d6d794c8e18dc8b0565"},{"type":"WEB","url":"https://github.com/rack/rack/commit/49386f460286b7346c7003b69a839de782cc8a39"},{"type":"PACKAGE","url":"https://github.com/rack/rack"},{"type":"WEB","url":"https://github.com/rack/rack/releases/tag/v3.1.23"},{"type":"WEB","url":"https://github.com/rack/rack/releases/tag/v3.2.8"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/GHSA-2j8w-xcrc-x985.yml"}],"database_specific":{"cwe_ids":["CWE-1286"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T19:11:28Z","nvd_published_at":"2026-11-09T22:18:42Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}]} |