CVE-2024-21510 Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
Attackers can trigger open redirects or cache poisoning via the X-Forwarded-Host header in Sinatra applications, potentially leading to SSRF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-21510?
CVE-2024-21510 is a medium-severity vulnerability in sinatra, published on 1 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
Weakness: CWE-807
Which versions are affected by CVE-2024-21510?
2 open source packages ship an affected version, including sinatra.
| Package | Affected | Fixed in |
|---|---|---|
sinatra RubyGems | All versions | 4.1.0 |
sinatra RubyGems | All versions | 4.1.0 |
Linux distribution packages (7)
pcs AlmaLinux:8 | All versions | 0.10.18-2.el8_10.3.alma.1 |
pcs-snmp AlmaLinux:8 | All versions | 0.10.18-2.el8_10.3.alma.1 |
pcs Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.18-2.el8_10.3 |
pcs-snmp Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.18-2.el8_10.3 |
pcs Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.18-2.el8_10.3 |
pcs-snmp Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.18-2.el8_10.3 |
pcs Rocky Linux:8 | All versions | 0:0.10.18-2.el8_10.3 |
How do I fix CVE-2024-21510?
Upgrade sinatra to 4.1.0 or later.
Is CVE-2024-21510 being exploited?
There is no known exploitation of CVE-2024-21510 in the wild and no public exploit code.
Sources
Also known as ALSA-2024:10987, DEBIAN-CVE-2024-21510, GHSA-hxx2-7vcw-mqr3, MINI-2f74-7rjv-jw4j, MINI-33jv-44cm-fpvg, MINI-5597-w9j2-r2m5 and 13 more.