Listen to this Post
The vulnerability exists within the Rack::Multipart::Parser component. During the parsing of a multipart/form-data request, the parser differentiates between file and non-file parts. File parts are safely streamed to temporary files on disk to avoid excessive memory consumption. However, for non-file parts—any form field without a filename attribute—the parser uses an in-memory String buffer. The code creates a new String object and appends all content from the non-file part directly into it. There is no upper limit on the size of data that can be written to this buffer. Consequently, an attacker can craft a malicious POST request containing a single, extremely large text field. As the server processes this request, the entire content of that field, potentially hundreds of megabytes, is loaded into the application’s RAM. This can rapidly exhaust the available memory of the server process, leading to an Out-of-Memory (OOM) condition, a crash, or severe performance degradation due to garbage collection overhead, effectively causing a Denial of Service.
Platform: Rack
Version: < 3.0.9, < 2.2.8
Vulnerability : Memory Exhaustion
Severity: Critical
date: 2024-XX-XX
Prediction: Patch by 2024-03-15
What Undercode Say:
curl -X POST -F "huge_field=@/dev/zero" $TARGET_URL
Example vulnerable code path in Rack::Multipart body = String.new Non-file buffer content = part.read body << content No size check
How Exploit:
Craft multipart request.
Omit filename parameter.
Send massive data field.
Server RAM fills.
Process crashes.
Protection from this CVE
Upgrade Rack gem.
Set client_max_body_size.
Use WAF filtering.
Impact:
Application Denial-of-Service.
Server memory exhaustion.
Unavailable worker processes.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
