Ruby Rack 3.x < 3.1.21 / 3.2.x < 3.2.6 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(305961);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/13");

  script_cve_id("CVE-2026-34827", "CVE-2026-34835", "CVE-2026-32762");
  script_xref(name:"IAVB", value:"2026-B-0085");

  script_name(english:"Ruby Rack 3.x < 3.1.21 / 3.2.x < 3.2.6 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the Rack Ruby library installed on the remote host is 3.0.0.beta1 or later but prior to 3.1.21,
or is 3.2.0 or later but prior to 3.2.6. It is, therefore, affected by multiple vulnerabilities:

  - Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters using repeated String#index
    searches with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear
    processing leading to denial of service (CVE-2026-34827)

  - Rack::Request parses Host header using AUTHORITY regex accepting characters not permitted in
    RFC-compliant hostnames (/, ?, #, @). Applications validating hosts with naive prefix/suffix checks
    can be bypassed, leading to host header poisoning (CVE-2026-34835)

  - Rack::Utils.forwarded_values parses RFC 7239 Forwarded header by splitting on semicolons before
    handling quoted-string values, allowing parameter smuggling (CVE-2026-32762)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/rack/rack/security/advisories/GHSA-v6x5-cg8r-vv6x");
  script_set_attribute(attribute:"see_also", value:"https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5");
  script_set_attribute(attribute:"see_also", value:"https://github.com/rack/rack/security/advisories/GHSA-qfgr-crr9-7r49");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Rack version 3.1.21 or 3.2.6 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-34827");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-34835");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ruby:rack");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ruby_modules_nix_installed.nbin", "ruby_gem_modules_macos_installed.nbin", "ruby_modules_win_installed.nbin");
  script_require_keys("Host/ruby/modules/enumerated");

  exit(0);
}

include('ruby.inc');

var gem_name = 'rack';

var app_info = ruby_gems::get_app_info(app:gem_name);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, gem_name);

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version': '3.0.0', 'fixed_version': '3.1.21'},
  {'min_version': '3.2.0', 'fixed_version': '3.2.6'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);