PT-2022-3422 · Rack+6 · Rack+6
Ooooooo_Q
·
Published
2022-05-27
·
Updated
2026-03-13
·
CVE-2022-30122
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Rack versions prior to 2.0.9.1
Rack versions prior to 2.1.4.1
Rack versions prior to 2.2.3.1
Description
A possible denial of service vulnerability exists in the multipart parsing component of Rack. This issue is related to insufficient checking of user-input data when parsing composite POST requests. Exploitation of this vulnerability may allow a remote attacker to perform a denial of service (DoS) attack using a specially crafted POST request. The vulnerability can be triggered by carefully crafted multipart POST requests, causing Rack's multipart parser to take longer than expected.
Recommendations
For Rack versions prior to 2.0.9.1, upgrade to version 2.0.9.1 or later.
For Rack versions prior to 2.1.4.1, upgrade to version 2.1.4.1 or later.
For Rack versions prior to 2.2.3.1, upgrade to version 2.2.3.1 or later.
As a temporary workaround, consider restricting the use of the
Rack::Multipart.parse multipart function until a patch is available.
Avoid using the request.POST and request.params methods to read POST data from a Rack request object until the issue is resolved.Exploit
Fix
DoS
RCE
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Rack
Red Os
Suse
Ubuntu