Listen to this Post
The vulnerability exists within the `Rack::Multipart::Parser` component. When parsing a multipart HTTP request, the parser searches for the initial boundary string that delineates the start of the form data. The flawed code continuously appends all incoming data received before this boundary into an unbounded internal string buffer (@sbuf), using @sbuf.concat(content). It then scans this buffer for the boundary pattern with @sbuf.scan_until(@body_regex). Since there is no size limit or data trimming mechanism for this preamble data, an attacker can send an extremely large stream of bytes (e.g., gigabytes) before finally sending the correct boundary string. This forces the server to allocate massive amounts of memory to buffer this preamble, leading to severe memory exhaustion, out-of-memory (OOM) process termination, and denial-of-service.
Platform: Ruby/Rack
Version: <3.0.9.1, <2.2.8.1
Vulnerability: DoS
Severity: Critical
date: 2024-02-27
Prediction: Patched 2024-02-27
What Undercode Say:
Simulating a malicious request with a large preamble curl -X POST http://target.com/upload \ -F "file=@real_file.txt" \ --data-binary @/dev/zero \ --header "Content-Type: multipart/form-data; boundary=boundary123"
Example of vulnerable parser loop while (content = io.read(8192)) @sbuf.concat(content) Vulnerable unbounded concatenation break if @sbuf.scan_until(@body_regex) end
How Exploit:
Craft multipart request.
Send massive preamble data.
Append valid boundary.
Exhaust server memory.
Protection from this CVE
Upgrade Rack version.
Limit request body size.
Implement memory quotas.
Impact:
Memory exhaustion.
Denial-of-Service.
Worker process crashes.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
