Listen to this Post
The vulnerability is a bypass of a previous fix for credential leakage in the Ruby URI gem. When the `+` operator is used to merge two URI objects, the implemented security check fails to properly sanitize the userinfo component (which contains credentials like username:password) from the original URI. This allows sensitive authentication details to be inadvertently copied into the newly constructed URI object. The leak occurs because the merging logic does not strip the userinfo subcomponent as required by RFC 3986 before combining URI parts, resulting in the credentials persisting in the scheme, host, or path of the resulting URI where they can be exposed in logs or to downstream systems.
Platform: URI Gem
Version: <0.12.5, 0.13.0-0.13.3, 1.0.0-1.0.4
Vulnerability: Credential Leakage Bypass
Severity: Low
Date: Dec 30 2025
Prediction: Patch Expected Jan 2025
What Undercode Say:
gem list uri
Vulnerable code example
uri1 = URI("http://user:[email protected]")
uri2 = URI("https://secure.com")
leaky_uri = uri1 + uri2 Credentials may leak
puts leaky_uri
How Exploit:
require 'uri'
original = URI("ftp://admin:[email protected]/resource")
target = URI("http://logserver.com/path")
malicious = original + target
Credentials 'admin:secret' may appear in malicious.to_s
Protection from this CVE
Upgrade to patched versions: 0.12.5, 0.13.3, or 1.0.4.
Impact:
Credential exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
