Ruby Rack 3.2.x < 3.2.6 Header Injection Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(305960);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2026-26962");
  script_xref(name:"IAVB", value:"2026-B-0085");

  script_name(english:"Ruby Rack 3.2.x < 3.2.6 Header Injection Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a header injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the Rack Ruby library installed on the remote host is 3.2.0 or later but prior to 3.2.6.
It is, therefore, affected by a header injection vulnerability:

  - Rack::Multipart::Parser unfolds folded multipart part headers incorrectly, preserving embedded CRLF
    in parsed parameter values instead of removing folded line break. Applications reusing these values
    in HTTP response headers may be vulnerable to header injection or response splitting. (CVE-2026-26962)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/rack/rack/security/advisories/GHSA-rx22-g9mx-qrhv");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Rack version 3.2.6 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-26962");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ruby:rack");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ruby_modules_nix_installed.nbin", "ruby_gem_modules_macos_installed.nbin", "ruby_modules_win_installed.nbin");
  script_require_keys("Host/ruby/modules/enumerated");

  exit(0);
}

include('ruby.inc');

var gem_name = 'rack';

var app_info = ruby_gems::get_app_info(app:gem_name);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, gem_name);

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version': '3.2.0', 'fixed_version': '3.2.6'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);