Debian dla-4706 : ruby-rack - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4706. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(331301);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/30");

  script_cve_id(
    "CVE-2024-26141",
    "CVE-2026-26961",
    "CVE-2026-34230",
    "CVE-2026-34763",
    "CVE-2026-34785",
    "CVE-2026-34786",
    "CVE-2026-34826",
    "CVE-2026-34829",
    "CVE-2026-34830",
    "CVE-2026-34831"
  );

  script_name(english:"Debian dla-4706 : ruby-rack - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the
dla-4706 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4706-1                [email protected]
    https://www.debian.org/lts/security/                          Abhijith PA
    July 31, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ruby-rack
    Version        : 2.1.4-3+deb11u6 2.2.22-0+deb12u2
    CVE ID         : CVE-2026-26961 CVE-2026-34230 CVE-2026-34763 CVE-2026-34785
                     CVE-2026-34786 CVE-2026-34826 CVE-2026-34829 CVE-2026-34830
                     CVE-2026-34831


    Multiple vulnerabilities were found in ruby-rack, a modular Ruby
    webserver interface

    CVE-2026-26961

        Rack::Multipart::Parser extracts the boundary parameter from
        multipart/form-data using a greedy regular expression. When a
        Content-Type header contains multiple boundary parameters, Rack
        selects the last one rather than the first. In deployments where
        an upstream proxy, WAF, or intermediary interprets the first
        boundary parameter, this mismatch can allow an attacker to smuggle
        multipart content past upstream inspection and have Rack parse a
        different body structure than the intermediary validated.

    CVE-2026-34230

        Rack::Utils.select_best_encoding processes Accept-Encoding values
        with quadratic time complexity when the header contains many
        wildcard (*) entries. Because this method is used by
        Rack::Deflater to choose a response encoding, an unauthenticated
        attacker can send a single request with a crafted Accept-Encoding
        header and cause disproportionate CPU consumption on the
        compression middleware path. This results in a denial of service
        condition for applications using Rack::Deflater.

    CVE-2026-34763

        Rack::Directory interpolates the configured root path directly
        into a regular expression when deriving the displayed directory
        path. If root contains regex metacharacters such as +, *, or .,
        the prefix stripping can fail and the generated directory listing
        may expose the full filesystem path in the HTML output.

    CVE-2026-34785

        Rack::Static determines whether a request should be served as a
        static file using a simple string prefix check. When configured
        with URL prefixes such as /css, it matches any request path that
        begins with that string, including unrelated paths such as
        /css-config.env or /css-backup.sql. As a result, files under
        the static root whose names merely share the configured prefix may
        be served unintentionally, leading to information disclosure.

    CVE-2026-34786

        Rack::Static#applicable_rules evaluates several header_rules types
        against the raw URL-encoded PATH_INFO, while the underlying
        file-serving path is decoded before the file is served. As a
        result, a request for a URL-encoded variant of a static path can
        serve the same file without the headers that header_rules were
        intended to apply. In deployments that rely on Rack::Static to
        attach security-relevant response headers to static content, this
        can allow an attacker to bypass those headers by requesting an
        encoded form of the path.

    CVE-2026-34826

        Rack::Utils.get_byte_ranges parses the HTTP Range header without
        limiting the number of individual byte ranges. Although the
        existing fix for CVE-2024-26141 rejects ranges whose total byte
        coverage exceeds the file size, it does not restrict the count of
        ranges. An attacker can supply many small overlapping ranges such
        as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O,
        and bandwidth consumption per request. This results in a denial of
        service condition in Rack file-serving paths that process
        multipart byte range responses.

    CVE-2026-34829

        Rack::Multipart::Parser only wraps the request body in a BoundedIO
        when CONTENT_LENGTH is present. When a multipart/form-data request
        is sent without a Content-Length header, such as with HTTP chunked
        transfer encoding, multipart parsing continues until end-of-stream
        with no total size limit. For file parts, the uploaded body is
        written directly to a temporary file on disk rather than being
        constrained by the buffered in-memory upload limit. An
        unauthenticated attacker can therefore stream an arbitrarily large
        multipart file upload and consume unbounded disk space. This
        results in a denial of service condition for Rack applications
        that accept multipart form data.

    CVE-2026-34830

        Rack::Sendfile#map_accel_path interpolates the value of the
        X-Accel-Mapping request header directly into a regular expression
        when rewriting file paths for X-Accel-Redirect. Because the header
        value is not escaped, an attacker who can supply X-Accel-Mapping
        to the backend can inject regex metacharacters and control the
        generated X-Accel-Redirect response header. In deployments using
        Rack::Sendfile with x-accel-redirect, this can allow an attacker
        to cause nginx to serve unintended files from configured internal
        locations.

    CVE-2026-34831

        Rack::Files#fail sets the Content-Length response header using
        String#size instead of String#bytesize. When the response body
        contains multibyte UTF-8 characters, the declared Content-Length
        is smaller than the number of bytes actually sent on the
        wire. Because Rack::Files reflects the requested path in 404
        responses, an attacker can trigger this mismatch by requesting a
        non-existent path containing percent-encoded UTF-8
        characters. This results in incorrect HTTP response framing and
        may cause response desynchronization in deployments that rely on
        the incorrect Content-Length value.

    For Debian 11 bullseye, these problems have been fixed in version
    2.1.4-3+deb11u6.

    For Debian 12 bookworm, these problems have been fixed in version
    2.2.22-0+deb12u2.

    We recommend that you upgrade your ruby-rack packages.

    For the detailed security status of ruby-rack please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-rack

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/ruby-rack");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-26141");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-26961");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34230");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34763");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34785");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34786");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34826");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34829");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34830");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34831");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/ruby-rack");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/ruby-rack");
  script_set_attribute(attribute:"solution", value:
"Upgrade the ruby-rack packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-34830");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/02/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ruby-rack");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+|^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0 / 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'ruby-rack', 'reference': '2.1.4-3+deb11u6'},
    {'release': '12.0', 'prefix': 'ruby-rack', 'reference': '2.2.22-0+deb12u2'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'ruby-rack');
}