CVE-2020-25613: WEBRick vulnerable to HTTP Request/Response Smuggling
(updated )
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
References
- github.com/advisories/GHSA-gwfg-cqmg-cf8f
- github.com/ruby/webrick
- github.com/ruby/webrick/commit/076ac636bf48b7a492887ce4de7041de23e6c00d
- github.com/ruby/webrick/commit/7618049fa57ddad2efff2a7bc7dad7d2d8a311b1
- github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7
- github.com/ruby/webrick/commit/af2efdcdf826f25592202d187c53963e7932e4b9
- github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2020-25613.yml
- hackerone.com/reports/965267
- lists.debian.org/debian-lts-announce/2023/04/msg00033.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV
- nvd.nist.gov/vuln/detail/CVE-2020-25613
- security.gentoo.org/glsa/202401-27
- security.netapp.com/advisory/ntap-20210115-0008
- www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613
Code Behaviors & Features
Detect and mitigate CVE-2020-25613 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →