Path Traversal in Rack::Static Causes Information Disclosure

Executive Summary

This vulnerability exists in the Ruby Rack library's Rack::Static middleware, which serves static files based on URL prefix matching.

Rack::Static uses a simple string prefix check to decide if a request path should be served as a static file. It checks if the request path starts with a configured prefix string (like "/css"), but it does not ensure that the prefix is followed by a path separator such as "/".

Because of this, requests for paths like "/css-config.env" or "/css-backup.sql" are matched and served if such files exist under the static root directory, even though these files are not intended to be exposed.

This leads to unintentional exposure of files whose names merely start with the configured prefix, causing information disclosure.

The issue has been fixed in patched versions of Rack that enforce stricter matching rules requiring the matched path to be exactly equal to the prefix or start with the prefix followed by a "/" character.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unintended information disclosure by allowing access to sensitive files such as configuration files, secrets, backups, and environment files located under the static root directory. Such exposure of sensitive information may result in non-compliance with data protection regulations and standards like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access.

Organizations using affected versions of Rack should update to patched versions and avoid placing sensitive files under the static root directory to mitigate the risk and maintain compliance with these standards.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability to access sensitive files located under the static root directory that share the configured URL prefix.

This may include configuration files, secrets, backup files, environment files, or other unintended static content.

Such unauthorized access leads to information disclosure, potentially exposing confidential data without requiring any privileges or user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Ruby Rack application is using an affected version of the Rack library (versions less than 2.2.23, versions >= 3.0 and < 3.1.21, or versions >= 3.2 and < 3.2.6) that uses the vulnerable Rack::Static middleware.

You can also test if your server unintentionally serves files whose names start with configured static URL prefixes but are not intended to be exposed. For example, if your static URL prefix is "/css", try requesting paths like "/css-config.env" or "/css-backup.sql" to see if these files are served.

Suggested commands to detect this behavior include using curl or wget to request such paths from your server:

• curl -I http://yourserver/css-config.env
• curl -I http://yourserver/css-backup.sql
• curl -I http://yourserver/csssecrets.yml

If these requests return HTTP 200 responses with file contents, it indicates the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating your Rack library to a patched version where this vulnerability is fixed. The patched versions are 2.2.23, 3.1.21, and 3.2.6.

Additionally, avoid placing sensitive files under the static root directory to prevent accidental exposure.

You should also review and adjust your static URL mappings to ensure they do not overlap with sensitive filenames.

Useful 0 Not Useful 0