sinatra Header X-Forwarded-Host reliance on untrusted inputs in a security decision

Summaryinfo

A vulnerability was found in sinatra. It has been declared as problematic. Affected is an unknown function of the component Header Handler. The manipulation of the argument X-Forwarded-Host results in reliance on untrusted inputs in a security decision. This vulnerability is identified as CVE-2024-21510. The attack can be executed remotely. There is not any exploit available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in sinatra (version now known). Affected is some unknown processing of the component Header Handler. The manipulation of the argument X-Forwarded-Host with an unknown input leads to a reliance on untrusted inputs in a security decision vulnerability. CWE is classifying the issue as CWE-807. The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. This is going to have an impact on confidentiality, and integrity. CVE summarizes:

Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.

The advisory is available at security.snyk.io. This vulnerability is traded as CVE-2024-21510 since 12/22/2023. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 212700 (RHEL 8 : pcs (RHSA-2024:10987)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (212700). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• sinatra

Website

• Product: https://github.com/sinatra/sinatra/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion