CVE-2023-22792
📋 TL;DR
This CVE describes a ReDoS (Regular Expression Denial of Service) vulnerability in Ruby on Rails Action Dispatch. Attackers can cause excessive CPU and memory usage by sending specially crafted cookies and X-Forwarded-Host headers, potentially leading to service disruption. All Ruby on Rails applications using affected versions are vulnerable.
💻 Affected Systems
- Ruby on Rails Action Dispatch
📦 What is this software?
Rails by Rubyonrails
Rails by Rubyonrails
Rails by Rubyonrails
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, affecting all users of the application.
Likely Case
Degraded performance and intermittent service disruptions during attack periods.
If Mitigated
Minimal impact with proper rate limiting, WAF rules, and updated versions.
🎯 Exploit Status
Exploitation requires sending specific cookie and header combinations but is straightforward once the pattern is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.6.1, 6.1.7.1, or 7.0.4.1
Vendor Advisory: https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115
Restart Required: Yes
Instructions:
1. Update Gemfile to specify patched version. 2. Run 'bundle update actionpack'. 3. Restart the Rails application server.
🔧 Temporary Workarounds
Rate Limiting
allImplement rate limiting on requests to mitigate DoS impact
WAF Rules
allConfigure WAF to block requests with suspicious X-Forwarded-Host headers
🧯 If You Can't Patch
- Implement strict input validation for X-Forwarded-Host headers
- Deploy application-level rate limiting and monitoring for abnormal CPU usage
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock for actionpack version: grep -i actionpack Gemfile.lockCheck Version:
bundle show actionpackVerify Fix Applied:
Verify actionpack version is 6.0.6.1, 6.1.7.1, or 7.0.4.1 or higher📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- Requests with malformed X-Forwarded-Host headers
- Slow response times
Network Indicators:
- Multiple requests with similar cookie/header patterns
- Abnormal request rates
SIEM Query:
source="rails.log" AND ("CPU" OR "slow" OR "timeout") AND "X-Forwarded-Host"🔗 References
- https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115
- https://security.netapp.com/advisory/ntap-20240202-0007/
- https://www.debian.org/security/2023/dsa-5372
- https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115
- https://security.netapp.com/advisory/ntap-20240202-0007/
- https://www.debian.org/security/2023/dsa-5372
