Find, fix and prevent vulnerabilities in your code.
high severity
- Vulnerable module: webrick
- Introduced through: webrick@1.8.1
Detailed paths
-
Introduced through: 1gor/htmg@1gor/htmg#a7ee8f39dce1e48e7968d949e08bd6619a67bfc7 › webrick@1.8.1Remediation: Upgrade to webrick@1.8.2.
Overview
webrick is a HTTP server toolkit that can be configured as an HTTPS server, a proxy server, and a virtual-host server.
Affected versions of this package are vulnerable to HTTP Request Smuggling via the read_headers method. An attacker can exploit inconsistent parsing of HTTP header terminators to inject arbitrary HTTP requests.
Note:
This is only exploitable if the application is deployed behind an HTTP proxy that fulfils specific conditions.
Remediation
Upgrade webrick to version 1.8.2 or higher.
References
medium severity
- Vulnerable module: webrick
- Introduced through: webrick@1.8.1
Detailed paths
-
Introduced through: 1gor/htmg@1gor/htmg#a7ee8f39dce1e48e7968d949e08bd6619a67bfc7 › webrick@1.8.1Remediation: Upgrade to webrick@1.8.2.
Overview
webrick is a HTTP server toolkit that can be configured as an HTTPS server, a proxy server, and a virtual-host server.
Affected versions of this package are vulnerable to HTTP Request Smuggling when httprequest.rb processes a request with both Content-Length and Transfer-Encoding headers. An attacker can send a GET /admin inside a POST /user to trick the server into treating the second one as a legitimate request, exposing unintended data.
Note: The package maintainers instruct users not to use this package in production and that it is no longer part of the Ruby language although it was in the past.
PoC
POST /user HTTP/1.1
Host: 127.0.0.1:8000
Content-Length: 50
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: 127.0.0.1:8000
Remediation
Upgrade webrick to version 1.8.2 or higher.