PT-2024-32484 · Ruby+5 · Webrick+5
Julianwu520
·
Published
2024-09-21
·
Updated
2025-11-26
·
CVE-2024-47220
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
WEBrick toolkit versions through 1.8.1
Description
An issue was discovered in the WEBrick toolkit for Ruby, allowing HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header. This can be achieved, for example, by including "GET /admin HTTP/1.1r
" inside a "POST /user HTTP/1.1r
" request. The supplier's position is that WEBrick should not be used in production.
Recommendations
For WEBrick toolkit versions through 1.8.1, consider disabling the use of both Content-Length and Transfer-Encoding headers in HTTP requests as a temporary workaround until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Red Os
Suse
Ubuntu
Webrick