Описание
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix.
A flaw was found in the rubygem-rack package. When a user provides the authorization credentials via Rack::Auth::Basic, if successful, the username is placed in env['REMOTE_USER'] and later used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username containing CRLF and white space characters or the server logs every login attempt. If an attacker enters a username with a CRLF character, the logger will log the malicious username with CRLF characters into the logfile. This flaw allows attackers to break log formats or insert fraudulent entries, potentially obscuring activity or injecting malicious data into log files.
Отчет
A moderate-impact log injection flaw was found in the rubygem-rack package, which ships in Red Hat Enterprise Linux 9 (the pcs component and the ruby-30, ruby-31, and ruby-33 container images) and is used by other Red Hat offerings, including Red Hat Satellite 6, Red Hat 3scale API Management Platform 2, OpenShift Logging, Red Hat Insights, and Hosted OpenShift, as well as Fedora and EPEL community streams. When a user authenticates via Rack::Auth::Basic, the supplied username is stored in the request environment and later written to the log file by Rack::CommonLogger. If an application allows usernames containing carriage return and line feed (CRLF) or other whitespace characters, or logs every login attempt, an attacker who controls such a username can inject forged entries into the log file, breaking log formats, obscuring real activity, or inserting malicious data into log files. The impact is limited to the integrity of log data: Red Hat and NIST both rate this flaw Moderate with a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), in line with the upstream CVSS 4.0 score of 5.7, also Moderate. Red Hat Enterprise Linux 10 is not affected because the vulnerable code is not present in that release. For the affected Red Hat Enterprise Linux 9 components and other delegated product and community streams, fixes are being pursued by the respective maintainers; for Red Hat 3scale API Management Platform 2 the maintainers decided not to fix the issue. For Red Hat Satellite 6.16 and 6.17 and the Red Hat Insights compliance-backend the fix is deferred, and the residual risk is limited to manipulation of log content by an authenticated user, with no direct impact on confidentiality or availability of the system itself.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel9 | Will not fix | ||
| Red Hat Enterprise Linux 10 | pcs | Not affected | ||
| Red Hat Enterprise Linux 7 | pcs | Out of support scope | ||
| Red Hat Enterprise Linux 8 | pcs | Out of support scope | ||
| Red Hat Enterprise Linux 9 | ruby-30 | Affected | ||
| Red Hat Enterprise Linux 9 | ruby-31 | Affected | ||
| Red Hat Enterprise Linux 9 | ruby-33 | Affected | ||
| Red Hat Satellite 6 | rubygem-rack | Fix deferred | ||
| Red Hat Storage 3 | rubygem-rack | Out of support scope | ||
| Red Hat Enterprise Linux 9 | pcs | Fixed | RHSA-2025:7085 | 13.05.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11...
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3
Rack provides an interface for developing web applications in Ruby. Pr ...
EPSS
6.5 Medium
CVSS3