CVE-2024-45614 Header normalization allows for client to clobber proxy set headers in Puma
Attackers can bypass proxy-set security headers by using underscore variants, potentially spoofing IP addresses or other trusted metadata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45614?
CVE-2024-45614 is a medium-severity vulnerability in puma, published on 19 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.
Which versions are affected by CVE-2024-45614?
4 open source packages ship an affected version, including puma. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
puma RubyGems | All versions | 5.6.9 |
puma RubyGems | All versions | 5.6.9 |
puma RubyGems | From 6.0.0 | 6.4.3 |
puma RubyGems | From 6.0.0 | 6.4.3 |
Linux distribution packages (1)
rubygem-puma openSUSE:Tumbleweed | All versions | 6.4.3-1.1 |
Products include Puma Puma.
How do I fix CVE-2024-45614?
Upgrade puma to a fixed version for your release line: 5.6.9 or 6.4.3.
Is CVE-2024-45614 being exploited?
There is no known exploitation of CVE-2024-45614 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in puma
Sources
Also known as DEBIAN-CVE-2024-45614, GHSA-9hf4-67fc-4vf4, OESA-2024-2249, OESA-2024-2251, UBUNTU-CVE-2024-45614, USN-7031-1 and 2 more.