GitHub Advisoryadvisory · RubyGems

GHSA-8cgq-6mh2-7j6v Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

MEDIUM Published 2025-03-04 Modified 2025-11-04 Official page ↗
Aliases
CVE-2025-27111
Ecosystem
RubyGems
Packages
rack
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-117, CWE-93
Reviewed
2025-03-04

Affected packages

• RubyGems rack: < 2.2.12 → fixed in 2.2.12 • RubyGems rack: >= 3.0, < 3.0.13 → fixed in 3.0.13 • RubyGems rack: >= 3.1, < 3.1.11 → fixed in 3.1.11

Description

Summary `Rack::Sendfile` can be exploited by crafting input that includes newline characters to manipulate log entries. Details The `Rack::Sendfile` middleware logs unsanitized header values from the `X-Sendfile-Type` header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. Impact This vulnerability can distort log files, obscure attack traces, and complicate security auditing. Mitigation • Update to the latest version of Rack, or • Remove usage of `Rack::Sendfile`.

Related

Alias · CVE (1)

  • CVE-2025-27111 Rack is a modular Ruby web server interface. vulnerability

Weakness · CWE (2)

  • CWE-117 Improper Output Neutralization for Logs weakness
  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References