PT-2024-1854 · Rack-Cors · Rack-Cors

Ajmilazzo · Published 2024-02-26 · Updated 2025-09-18 · CVE-2024-27456

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions rack-cors (aka Rack CORS Middleware) version 2.0.1

Description The issue is related to incorrectly used standard permissions in the Rack CORS Middleware, which may allow an attacker to impact the integrity, confidentiality, and availability of information. The .rb files have 0666 permissions.

Recommendations For version 2.0.1, consider changing the permissions of the .rb files to a more secure setting to prevent potential exploitation. As a temporary workaround, restrict access to the .rb files until a patch is available.

Exploit

Fix

Incorrect Default Permissions

Information Disclosure

Weakness Enumeration

CWE-276

CWE-200

Related Identifiers

BDU:2024-01609

CVE-2024-27456

GHSA-785G-282Q-PWVX

Affected Products

Rack-Cors

References · 15

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-cors/CVE-2024-27456.yml · Exploit
• https://github.com/cyu/rack-cors/issues/274 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27456 · Security Note
• https://bdu.fstec.ru/vul/2024-01609 · Security Note
• https://osv.dev/vulnerability/GHSA-785g-282q-pwvx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27456 · Vendor Advisory
• https://github.com/cyu/rack-cors/blob/878063987bd1ca956282dda95697fd821bf24d2e/CHANGELOG.md#changed · Note
• https://github.com/cyu/rack-cors · Note
• https://github.com/advisories/GHSA-785g-282q-pwvx · Note
• https://twitter.com/rubylandnews/status/1762573485291778268 · Twitter Post
• https://t.me/cvenotify/88635 · Telegram Post
• https://access.redhat.com/security/cve/cve-2024-27456 · Note
• https://twitter.com/VulmonFeeds/status/1762169993557356965 · Twitter Post
• https://twitter.com/CVEnew/status/1762013697336017132 · Twitter Post
• https://t.me/cveNotify/135819 · Telegram Post