Puma up to 5.6.8/6.4.2 Header X-Forwarded_For authorization

Summaryinfo

A vulnerability was found in Puma up to 5.6.8/6.4.2. It has been classified as problematic. The affected element is an unknown function of the component Header Handler. This manipulation of the argument X-Forwarded_For causes authorization. This vulnerability is registered as CVE-2024-45614. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Puma up to 5.6.8/6.4.2 and classified as problematic. Affected by this vulnerability is an unknown code block of the component Header Handler. The manipulation of the argument X-Forwarded_For with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-45614 since 09/02/2024. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 207712 (Ubuntu 20.04 LTS / 22.04 LTS : Puma vulnerability (USN-7031-2)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.6.9 or 6.4.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (207712). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Puma

Version

• 5.6.0
• 5.6.1
• 5.6.2
• 5.6.3
• 5.6.4
• 5.6.5
• 5.6.6
• 5.6.7
• 5.6.8
• 6.4.0
• 6.4.1
• 6.4.2

Website

• Product: https://github.com/puma/puma/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion