Overview
Rack provides an interface for developing web applications in Ruby. A vulnerability was identified in the Rack::CommonLogger component, where attackers can exploit CRLF injection to manipulate log entries. This issue is prevalent when usernames containing CRLF characters are logged, which can break log formats or insert fraudulent entries. This affects versions before 2.2.11, 3.0.12, and 3.1.10.
Details
Module Info
- Product: Rack
- Affected packages: rack
- Affected versions: <2.2.11, <3.0.12, <3.1.10
- Github repository: https://github.com/rack/rack
- Published packages: https://rubygems.org/gems/rack
- Package manager: RubyGems
- Fixed in: Rack v2.2.11, v3.0.12, v3.1.10
Vulnerability Info
CVE-2025-25184 is a medium-severity vulnerability in Rack::CommonLogger, affecting versions before 2.2.11, 3.0.12, and 3.1.10. It allows CRLF characters to be injected into log entries via malicious usernames, potentially obscuring real activities or injecting malicious data into log files. The issue occurs when the application logs usernames containing CRLF characters, which can manipulate the log format.
Steps To Reproduce
1. Set up a Rack application using an affected version. 2. Create a user with a username containing CRLF characters. 3. Log in using this username. 4. Observe the log entries to see if the malicious username affects the log format.
Mitigation
Upgrade to Rack versions 2.2.11, 3.0.12, or 3.1.10 where the issue is fixed. If an upgrade is not possible, consider using a commercial support partner like HeroDevs to implement a custom logging solution that sanitizes log inputs.
Credit
- HexSave
