Researchers Identify Rack::Static Vulnerability Enabling Data Breaches in Ruby Servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-25184 | Rack provides an interface for developing web applications in Ruby. Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix. NVD description · AI analysis pending | 5.7 | 1% | PoC |
| — | |
| CVE-2025-27111 | Rack is a modular Ruby web server interface. Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11. NVD description · AI analysis pending | 6.9 | <1% |
| — | ||
| CVE-2025-27610 | Rack provides an interface for developing web applications in Ruby. Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of `Rack::Static`, or ensuring that `root:` points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue. NVD description · AI analysis pending | 7.5 | 1% |
| — | ||
| CVE-2025-43928 | In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username fie In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing. NVD description · AI analysis pending | 9.8 | <1% | PoC |
| — |
Full article668 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 25, 2025Vulnerability / Data Breach
Cybersecurity researchers have disclosed three security flaws in the Rack Ruby web server interface that, if successfully exploited, could enable attackers to gain unauthorized access to files, inject malicious data, and tamper with logs under certain conditions.
The vulnerabilities, flagged by cybersecurity vendor OPSWAT, are listed below -
- CVE-2025-27610 (CVSS score: 7.5) - A path traversal vulnerability that could be used to gain access to all files under the specified root: directory, assuming an attacker can determine the paths to those files
- CVE-2025-27111 (CVSS score: 6.9) - An improper neutralization of carriage return line feeds (CRLF) sequences and improper output neutralization for logs vulnerability that could be used to manipulate log entries and distort log files
- CVE-2025-25184 (CVSS score: 5.7) - An improper neutralization of carriage return line feeds (CRLF) sequences and improper output neutralization for logs vulnerability that could be used to manipulate log entries and inject malicious data
Successful exploitation of the flaws could permit an attacker to obscure attack traces, read arbitrary files, and inject malicious code.
"Among these vulnerabilities, CVE-2025-27610 is particularly severe, as it could enable unauthenticated attackers to retrieve sensitive information, including configuration files, credentials, and confidential data, thereby leading to data breaches," OPSWAT said in a report shared with The Hacker News.
The shortcoming stems from the fact that Rack::Static, a middleware that's used to serve static content like JavaScript, stylesheets, and images, does not sanitize user-supplied paths before serving files, leading to a scenario where an attacker can provide a specially crafted path to access files outside of the static file directory.
"Specifically, when the :root parameter is not explicitly defined, Rack defaults this value to the current working directory by assigning it the value of Dir.pwd, implicitly designating it as the web root directory for the Rack application," OPSWAT said.
As a result, if the :root option is either undefined or misconfigured relative to the :urls option, an unauthenticated attacker could weaponize CVE-2025-27610 through path traversal techniques to access sensitive files outside the intended web directory.
To mitigate the risk posed by the flaw, it's advised to update to the latest version. If immediate patching is not an option, it's recommended to remove usage of Rack::Static, or ensure that root: points at a directory path that only contains files that should be accessed publicly.
Critical Flaw in Infodraw Media Relay Service
The disclosure comes as a critical security defect has been unearthed in the Infodraw Media Relay Service (MRS) that allows reading or deletion of arbitrary files via a path traversal vulnerability (CVE-2025-43928, CVSS score: 9.8) in the username parameter in the login page of the system.
Infodraw is an Israeli maker of mobile video surveillance solutions that are used to transmit audio, video, and GPS data over telecommunications networks. According to the company's website, its devices are used by law enforcement, private investigations, fleet management, and public transport in many countries.
"A trivial Path Traversal vulnerability allows it to read out any file from systems for unauthenticated attackers," security researcher Tim Philipp Schäfers said in a statement shared with The Hacker News. "Furthermore an 'Arbitrary File Deletion Vulnerability' exists that allows attackers to delete any file from the system."
The flaw, which enables login with a username like "../../../../," affects both Windows and Linux versions of MRS. That said, the security defect continues to remain unpatched. Vulnerable systems in Belgium and Luxembourg have been taken offline following responsible disclosure.
"Affected organizations are primarily advised to take the application offline immediately (since, despite early warnings, no manufacturer patch is available, and it is considered possible that the vulnerability will be exploited by malicious actors in the near future)," Philipp Schäfers said.
"If this is not possible, systems should be further protected with additional measures (such as using a VPN or specific IP unlocking)."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/04/researchers-identify-rackstatic.html