CVE-2025-61780

{"id": "CVE-2025-61780", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61780", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-10T20:34:55.399317Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rack", "product": "rack", "versions": [{"status": "affected", "version": "< 2.2.20"}, {"status": "affected", "version": ">= 3.0, < 3.1.18"}, {"status": "affected", "version": ">= 3.2, < 3.2.3"}]}]}], "published": "2025-10-10T17:15:39.557", "references": [{"url": "https://github.com/rack/rack/commit/57277b7741581fa827472c5c666f6e6a33abd784", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rack/rack/commit/7e69f65eefe9cd2868df9f9f3b0977b86f93523a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rack/rack/commit/fba2c8bc63eb787ff4b19bc612d315fda6126d85", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rack/rack/security/advisories/GHSA-r657-rxjc-j557", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sendfile` when running behind a proxy that supports `x-sendfile` headers (such as Nginx). Specially crafted headers could cause `Rack::Sendfile` to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions. When `Rack::Sendfile` received untrusted `x-sendfile-type` or `x-accel-mapping` headers from a client, it would interpret them as proxy configuration directives. This could cause the middleware to send a \"redirect\" response to the proxy, prompting it to reissue a new internal request that was not subject to the proxy's access controls. An attacker could exploit this by setting a crafted `x-sendfile-type: x-accel-redirect` header, setting a crafted `x-accel-mapping` header, and requesting a path that qualifies for proxy-based acceleration. Attackers could bypass proxy-enforced restrictions and access internal endpoints intended to be protected (such as administrative pages). The vulnerability did not allow arbitrary file reads but could expose sensitive application routes. This issue only affected systems meeting all of the following conditions: The application used `Rack::Sendfile` with a proxy that supports `x-accel-redirect` (e.g., Nginx); the proxy did **not** always set or remove the `x-sendfile-type` and `x-accel-mapping` headers; and the application exposed an endpoint that returned a body responding to `.to_path`. Users should upgrade to Rack versions 2.2.20, 3.1.18, or 3.2.3, which require explicit configuration to enable `x-accel-redirect`. Alternatively, configure the proxy to always set or strip the header, or in Rails applications, disable sendfile completely."}, {"lang": "es", "value": "Rack es una interfaz modular de servidor web Ruby. Versiones anteriores a la 2.2.20, 3.1.18 y 3.2.3, exist\u00eda una posible vulnerabilidad de revelaci\u00f3n de informaci\u00f3n en \u2019Rack::Sendfile\u2019 al ejecutarse detr\u00e1s de un proxy que soporta cabeceras \u2019x-sendfile\u2019 (como Nginx). Cabeceras especialmente manipuladas podr\u00edan causar que \u2019Rack::Sendfile\u2019 se comunicara err\u00f3neamente con el proxy y desencadenara solicitudes internas no intencionadas, eludiendo potencialmente las restricciones de acceso a nivel de proxy. Cuando \u2019Rack::Sendfile\u2019 recib\u00eda cabeceras \u2019x-sendfile-type\u2019 o \u2019x-accel-mapping\u2019 no confiables de un cliente, las interpretaba como directivas de configuraci\u00f3n del proxy. Esto podr\u00eda causar que el middleware enviara una respuesta de \u2019redirect\u2019 al proxy, lo que lo impulsar\u00eda a reemitir una nueva solicitud interna que no estaba sujeta a los controles de acceso del proxy. Un atacante podr\u00eda explotar esto configurando una cabecera \u2019x-sendfile-type: x-accel-redirect\u2019 manipulada, configurando una cabecera \u2019x-accel-mapping\u2019 manipulada y solicitando una ruta que califique para la aceleraci\u00f3n basada en proxy. Los atacantes podr\u00edan eludir las restricciones impuestas por el proxy y acceder a endpoints internos destinados a ser protegidos (como p\u00e1ginas administrativas). La vulnerabilidad no permit\u00eda lecturas arbitrarias de archivos, pero podr\u00eda exponer rutas sensibles de la aplicaci\u00f3n. Este problema solo afectaba a sistemas que cumpl\u00edan todas las siguientes condiciones: La aplicaci\u00f3n utilizaba \u2019Rack::Sendfile\u2019 con un proxy que soporta \u2019x-accel-redirect\u2019 (por ejemplo, Nginx); el proxy no siempre establec\u00eda o eliminaba las cabeceras \u2019x-sendfile-type\u2019 y \u2019x-accel-mapping\u2019; y la aplicaci\u00f3n expon\u00eda un endpoint que devolv\u00eda un cuerpo que respond\u00eda a \u2019.to_path\u2019. Los usuarios deber\u00edan actualizar a las versiones de Rack 2.2.20, 3.1.18 o 3.2.3, que requieren configuraci\u00f3n expl\u00edcita para habilitar \u2019x-accel-redirect\u2019. Alternativamente, configure el proxy para que siempre establezca o elimine la cabecera, o en aplicaciones Rails, deshabilite sendfile por completo."}], "lastModified": "2026-10-19T22:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "2077D030-4BE1-4CB4-8C9B-ACCA0B01BB0D", "versionEndExcluding": "2.2.20"}, {"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "52554FFF-7EF2-473A-8686-6D029CC8F6EF", "versionEndExcluding": "3.1.18", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "AA3F6ADB-DBDD-4C26-A019-D5AE5961F3CC", "versionEndExcluding": "3.2.3", "versionStartIncluding": "3.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}