Internet Bug Bounty · Report #2520679

Possible DoS Vulnerability with Range Header in Rack

Validstatus

highseverity

$5,420bounty

56upvotes

25 Sept 2024disclosed

Summary

Possible DoS Vulnerability with Range Header in Rack

There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.

Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1

Impact Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.

Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications).

Credits Thank you ooooooo_q for the report and patch

Full Security Advisory: https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944

How it was found

I made a report and patch at https://hackerone.com/reports/2307813.

https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944

There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141. Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1

Impact

Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.

Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications).

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original