CVE-2024-39316
📋 TL;DR
This CVE describes a Regular Expression Denial of Service (ReDoS) vulnerability in Rack's HTTP Accept header parsing. Attackers can send specially crafted Accept-Encoding or Accept-Language headers to cause excessive server processing time, leading to denial of service. Users of Rack versions 3.1.0 through 3.1.4 are affected.
💻 Affected Systems
- Rack
📦 What is this software?
Rack by Rack
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion from malicious requests, potentially affecting all users of the vulnerable application.
Likely Case
Degraded performance and intermittent service disruptions for legitimate users when attackers send crafted headers.
If Mitigated
Minimal impact with proper rate limiting, request filtering, and monitoring in place to detect and block malicious patterns.
🎯 Exploit Status
Exploitation requires sending HTTP requests with malicious Accept headers; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.5
Vendor Advisory: https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
Restart Required: Yes
Instructions:
1. Update Gemfile to specify 'rack', '~> 3.1.5' 2. Run 'bundle update rack' 3. Restart the application server
🔧 Temporary Workarounds
Request Header Filtering
allFilter or reject requests with suspicious Accept-Encoding or Accept-Language headers at the web server or application firewall level.
Rate Limiting
allImplement rate limiting on HTTP requests to mitigate DoS impact.
🧯 If You Can't Patch
- Implement WAF rules to block requests with malformed Accept headers
- Deploy additional monitoring for CPU spikes and unusual request patterns
🔍 How to Verify
Check if Vulnerable:
Check Rack version in Gemfile.lock or via 'bundle show rack' command.Check Version:
bundle show rack | grep rackVerify Fix Applied:
Confirm Rack version is 3.1.5 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Requests with unusually long Accept-Encoding or Accept-Language headers
- Increased CPU usage on web servers
Network Indicators:
- HTTP requests containing crafted Accept headers with repetitive patterns
SIEM Query:
source="web_server_logs" AND (header="Accept-Encoding" OR header="Accept-Language") AND length(value) > 500🔗 References
- https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
- https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
- https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
- https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
- https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
- https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
