PT-2025-41580 · Rack+5 · Rack+5

Ioquatix · Published 2025-10-10 · Updated 2026-05-07 · CVE-2025-61780

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.20 Rack versions prior to 3.1.18 Rack versions prior to 3.2.3

Description Rack is a modular Ruby web server interface. A potential information disclosure issue existed in Rack::Sendfile when operating behind a proxy supporting x-sendfile headers, such as Nginx. Maliciously crafted headers could lead Rack::Sendfile to incorrectly communicate with the proxy, potentially circumventing proxy-level access restrictions. Specifically, when receiving untrusted x-sendfile-type or x-accel-mapping headers, the middleware could be tricked into sending a redirect response to the proxy, triggering a new internal request that bypasses access controls. An attacker could exploit this by setting a crafted x-sendfile-type: x-accel-redirect header and a crafted x-accel-mapping header, requesting a path that qualifies for proxy-based acceleration. This could expose sensitive application routes. The issue requires the application to use Rack::Sendfile with a proxy that supports x-accel-redirect, the proxy not consistently setting or removing the x-sendfile-type and x-accel-mapping headers, and the application exposing an endpoint that returns a body responding to .to path.

Recommendations Upgrade to Rack version 2.2.20. Upgrade to Rack version 3.1.18. Upgrade to Rack version 3.2.3. Alternatively, configure the proxy to always set or strip the header. In Rails applications, disable sendfile completely.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-913

CWE-441

Related Identifiers

BDU:2025-13873

CVE-2025-61780

DLA-4357-1

DSA-6048-1

GHSA-R657-RXJC-J557

MGASA-2025-0334

SUSE-SU-2025:4273-1

SUSE-SU-2025_4273-1

USN-7960-1

Affected Products

Debian

Linuxmint

Rack

Red Os

Suse

Ubuntu

References · 52

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61780.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-61780.yml · Exploit
• https://github.com/rack/rack/commit/57277b7741581fa827472c5c666f6e6a33abd784 · Patch
• https://github.com/rack/rack/security/advisories/GHSA-r657-rxjc-j557 · Vendor Advisory
• https://github.com/rack/rack/commit/fba2c8bc63eb787ff4b19bc612d315fda6126d85 · Patch
• https://github.com/rack/rack/commit/7e69f65eefe9cd2868df9f9f3b0977b86f93523a · Patch
• https://cve.org/CVERecord?id=CVE-2025-61780 · Security Note
• https://ubuntu.com/security/CVE-2025-61771 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61770 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61780 · Security Note
• https://osv.dev/vulnerability/GHSA-r657-rxjc-j557 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7960-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61919 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0334.html · Security Note