En resumen
- CVE-2021-29479 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a io.ratpack:ratpack-core, ratpack (ratpack project).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.86%, mayor que el 58.6% de las vulnerabilidades.
- Solución: actualizar a 1.9.0 o posterior.
Description
A user supplied X-Forwarded-Host header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the X-Forwarded-Host header as a cache key.
Users are only vulnerable if they do not configure a custom PublicAddress instance. A custom PublicAddress can be specified by using ServerConfigBuilder::publicAddress. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of PublicAddress which is vulnerable.
Impact
This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location.
Patches
As of Ratpack 1.9.0, two changes have been made that mitigate this vulnerability:
- The default PublicAddress implementation no longer infers the address from the request context, instead relying on the configured bind host/port
- Relative redirects issued by the application are no longer absolutized; they are passed through as-is
Workarounds
In production, ensure that ServerConfigBuilder::publicAddress correctly configures the server.
References
NVD description
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production.
Más vulnerabilidades de io.ratpack:ratpack-core
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free