PT-2021-18241 · Ratpack · Ratpack

Published 2021-06-29 · Updated 2021-07-08 · CVE-2021-29479

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Ratpack versions prior to 1.9.0

Description: The issue allows a user-supplied X-Forwarded-Host header to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the X-Forwarded-Host header as a cache key. Users are only vulnerable if they do not configure a custom PublicAddress instance. By default, Ratpack utilizes an inferring version of PublicAddress which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location.

Recommendations: For versions prior to 1.9.0, ensure that ServerConfigBuilder::publicAddress correctly configures the server in production to mitigate the issue. As a temporary workaround, consider configuring a custom PublicAddress instance to prevent the use of the inferring version of PublicAddress. Update to Ratpack 1.9.0 or later, which includes changes that mitigate this vulnerability, such as a new default PublicAddress implementation and changes to relative redirects.

Exploit

Fix

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2021-29479

GHSA-W6RQ-6H34-VH7Q

Affected Products

Ratpack

References · 7

• 🔥 https://portswigger.net/web-security/web-cache-poisoning · Exploit
• https://osv.dev/vulnerability/CVE-2021-29479 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w6rq-6h34-vh7q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29479 · Security Note
• https://github.com/ratpack/ratpack/security/advisories/GHSA-w6rq-6h34-vh7q · Note
• https://github.com/ratpack/ratpack · Note
• https://t.me/cvenotify/16839 · Telegram Post