Описание
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
A flaw was found in Faraday, an HTTP client library. This vulnerability allows a remote attacker to perform off-host request forgery by exploiting a protocol-relative host override when a request target is passed as a URI object. This can redirect a request from a fixed-base Faraday connection to an attacker-controlled host, potentially exposing sensitive information such as Authorization headers and default query parameters.
Отчет
Red Hat products include the Faraday Ruby gem as an indirect dependency. This vulnerability allows off-host request forgery when a request target is passed as a URI object rather than a String to Faraday::Connection#build_exclusive_url. Exploitation requires the application to construct Faraday requests using URI objects with attacker-controlled input, which limits the exposure in typical Red Hat product usage.
Меры по смягчению последствий
Ensure that request targets passed to Faraday connections use String types rather than URI objects. Validate and sanitize all user-controlled input before using it to construct HTTP request targets.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/system | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/zync | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/system | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/zync | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel9 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel8 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel9 | Fix deferred | ||
| Red Hat Satellite 6 | rubygem-faraday | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
Faraday is an HTTP client library abstraction layer that provides a co ...
Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping
EPSS
6.3 Medium
CVSS3