CVE-2024-35231 rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter
An attacker can cause a denial of service by sending unconstrained profiler_runs parameters, exhausting server resources in rack-contrib.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35231?
CVE-2024-35231 is a high-severity denial of service vulnerability in rack-contrib, published on 27 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.
Weakness: CWE-770
Which versions are affected by CVE-2024-35231?
2 open source packages ship an affected version, including rack-contrib.
| Package | Affected | Fixed in |
|---|---|---|
rack-contrib RubyGems | All versions | 2.5.0 |
rack-contrib RubyGems | All versions | 2.5.0 |
How do I fix CVE-2024-35231?
Upgrade rack-contrib to 2.5.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-35231 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35231 exists.
Sources
Also known as GHSA-8c8q-2xw3-j869, UBUNTU-CVE-2024-35231.