Ruby RACK 3.1.x < 3.1.16 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(237897);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/23");

  script_cve_id("CVE-2025-49007");
  script_xref(name:"IAVB", value:"2025-B-0088-S");

  script_name(english:"Ruby RACK 3.1.x < 3.1.16 DoS");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a DoS vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the RACK Ruby library installed on the remote host is 3.1.x prior to 3.1.16 . It is, 
therefore, affected by a DoS vulnerability where an attacker can create a crafted input can cause Content-Disposition 
header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. 
This header is typically used in multipart parsing. Any applications that parse multipart posts using Rack 
(virtually all Rails applications) are impacted.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m");
  script_set_attribute(attribute:"solution", value:
"Upgrade to RACK version 3.1.16 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-49007");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ruby:rack");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ruby_modules_nix_installed.nbin", "ruby_gem_modules_macos_installed.nbin", "ruby_modules_win_installed.nbin");
  script_require_keys("Host/ruby/modules/enumerated");

  exit(0);
}
include('ruby.inc');

var gem_name = 'rack';

var app_info = ruby_gems::get_app_info(app:gem_name);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, gem_name);

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version': '3.1', 'fixed_version': '3.1.16'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);