Description (CNA)
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| rack / rack | affected < 2.2.22; affected >= 3.0.0.beta1, < 3.1.20; affected >= 3.2.0, < 3.2.5 |
CWE
CWE-22, CWE-548
References
- https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh
- https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7
ADP enrichment
No English description supplied.
No references supplied.
A path traversal flaw has been discovered in the rubygem Rack. Rack::Directory’s path check used a string prefix match on the expanded path. A request like /../root_example/ can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. In directory.rb, File.expand_path(File.join(root, path_info)).start_with?(root) does not enforce a path boundary. If the server root is /var/www/root, a path like /var/www/root_backup passes the check because it shares the same prefix, so Rack::Directory will list that directory also.