CVE-2021-29479
📋 TL;DR
This vulnerability allows attackers to poison web caches by manipulating the X-Forwarded-Host header in Ratpack applications. It enables redirect cache poisoning where users can be redirected to malicious sites instead of legitimate destinations. Only Ratpack servers using the default PublicAddress configuration without custom cache key settings are affected.
💻 Affected Systems
- Ratpack
📦 What is this software?
Ratpack by Ratpack Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect all users of a vulnerable application to phishing sites, steal credentials, or distribute malware through poisoned redirects.
Likely Case
Targeted cache poisoning leading to user redirection to attacker-controlled sites for phishing or credential harvesting.
If Mitigated
No impact if proper PublicAddress configuration or patched version is used.
🎯 Exploit Status
Exploitation requires ability to send HTTP requests with X-Forwarded-Host header to vulnerable server behind a cache.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.0
Vendor Advisory: https://github.com/ratpack/ratpack/security/advisories/GHSA-w6rq-6h34-vh7q
Restart Required: Yes
Instructions:
1. Update Ratpack dependency to version 1.9.0 or later. 2. Update build.gradle or pom.xml to use ratpack:1.9.0+. 3. Rebuild and redeploy application. 4. Restart server.
🔧 Temporary Workarounds
Configure PublicAddress
allManually configure ServerConfigBuilder::publicAddress with correct server address instead of using default inference.
ratpack { serverConfig { publicAddress(URI.create("https://your-domain.com")) } }
🧯 If You Can't Patch
- Configure web cache to include X-Forwarded-Host header in cache keys
- Implement WAF rules to validate or strip X-Forwarded-Host headers
🔍 How to Verify
Check if Vulnerable:
Check if Ratpack version <1.9.0 and using default PublicAddress configuration without custom cache keys.Check Version:
Check build.gradle for 'ratpack' version or examine deployed application dependencies.Verify Fix Applied:
Verify Ratpack version is 1.9.0+ and PublicAddress is properly configured or custom cache keys include X-Forwarded-Host.📡 Detection & Monitoring
Log Indicators:
- Unusual X-Forwarded-Host header values in access logs
- Multiple redirects to unexpected domains
Network Indicators:
- HTTP requests with manipulated X-Forwarded-Host headers
- Unexpected redirect responses from cache
SIEM Query:
http.headers:X-Forwarded-Host AND http.status:301 OR http.status:302