CVE-2024-45614 PoC — Header normalization allows for client to clobber proxy set headers in Puma

Source

https://github.com/ooooooo-q/puma_header_normalization-CVE-2024-45614

Associated Vulnerability

Title: Header normalization allows for client to clobber proxy set headers in Puma (CVE-2024-45614)
Description:Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.

Description

Puma Header normalization CVE-2024-45614 確認

Readme

Puma Header normalization CVE-2024-45614 確認
===

- advisory: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4
- 修正コミット: https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043


### 結果

[request.rb](requests.rb)の実行結果

#### duplicate
| 対象 | 結果 | 
| --- | --- |
| puma_before_fix_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_before_fix_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_after_fix_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_after_fix_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| pitchfork_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| pitchfork_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| unicorn_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| unicorn_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| thin_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| falcon_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| nginx_unicorn_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| nginx_unicorn_rack2_underscore_on | X_FORWARDED_FOR: 2.2.2.2 |

#### under_score
| 対象 | 結果 | 
| --- | --- |
| puma_before_fix_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_before_fix_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_after_fix_rack2 | X_FORWARDED_FOR: 1.1.1.1 |
| puma_after_fix_rack3 | X_FORWARDED_FOR: 1.1.1.1 |
| pitchfork_rack2 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| pitchfork_rack3 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| unicorn_rack2 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| unicorn_rack3 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| thin_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| falcon_rack3 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| nginx_unicorn_rack2 | X_FORWARDED_FOR: 1.1.1.1 |
| nginx_unicorn_rack2_underscore_on | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |

#### reverse_under_score
| 対象 | 結果 | 
| --- | --- |
| puma_before_fix_rack2 | X_FORWARDED_FOR: 1.1.1.1 |
| puma_before_fix_rack3 | X_FORWARDED_FOR: 1.1.1.1 |
| puma_after_fix_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_after_fix_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| pitchfork_rack2 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| pitchfork_rack3 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| unicorn_rack2 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| unicorn_rack3 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| thin_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| falcon_rack3 | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |
| nginx_unicorn_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| nginx_unicorn_rack2_underscore_on | X_FORWARDED_FOR: 1.1.1.1,2.2.2.2 |

#### upper_case
| 対象 | 結果 | 
| --- | --- |
| puma_before_fix_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_before_fix_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_after_fix_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_after_fix_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| pitchfork_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| pitchfork_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| unicorn_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| unicorn_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| thin_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| falcon_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| nginx_unicorn_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| nginx_unicorn_rack2_underscore_on | X_FORWARDED_FOR: 2.2.2.2 |

#### reverse_upper_case
| 対象 | 結果 | 
| --- | --- |
| puma_before_fix_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_before_fix_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_after_fix_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| puma_after_fix_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| pitchfork_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| pitchfork_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| unicorn_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| unicorn_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| thin_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| falcon_rack3 | X_FORWARDED_FOR: 2.2.2.2 |
| nginx_unicorn_rack2 | X_FORWARDED_FOR: 2.2.2.2 |
| nginx_unicorn_rack2_underscore_on | X_FORWARDED_FOR: 2.2.2.2 |

### 各サーバ起動

#### Puma

```
# CVE-2024-45614修正前 Rack2
$ cd puma_before_fix_rack2 
$ RACK_ENV=production bundle exec puma -p 9000 ../config.ru

# CVE-2024-45614修正前 Rack3
$ cd puma_before_fix_rack3 
$ RACK_ENV=production bundle exec puma -p 9001 ../config.ru

# CVE-2024-45614修正後 Rack2
$ cd puma_after_fix_rack2
$ RACK_ENV=production bundle exec puma -p 9002 ../config.ru

# CVE-2024-45614修正後 Rack3
$ cd puma_after_fix_rack2 
$ RACK_ENV=production bundle exec puma -p 9003 ../config.ru
```

#### Pitchfork

```
# Rack2
$ cd pitchfork_rack2 
$ RACK_ENV=production bundle exec pitchfork -p 9010 ../config.ru

# Rack3
$ cd pitchfork_rack3 
$ RACK_ENV=production bundle exec pitchfork -p 9011 ../config.ru
```

#### Unicorn

```
# Rack2
$ cd unicorn_rack2 
$ RACK_ENV=production bundle exec unicorn -p 9020 ../config.ru

# Rack3
# * 調査時のバージョンではRack3の対応は完了していないが、サーバは動く
$ cd unicorn_rack3 
$ RACK_ENV=production bundle exec unicorn -p 9021 ../config.ru
```      

#### Thin

```
# Rack2
$ cd thin_rack2 
$ RACK_ENV=production bundle exec thin start -p 9030 -R ../config.ru

# Rack3
# * 調査のバージョンではRack3に未対応であり、bundle installができない
```    

#### Falcon

* 確認しやすくするためにHTTP1で起動

```
# Rack2
$ cd falcon_rack2 
$ RACK_ENV=production bundle exec rackup --server falcon -p 9040 ../config.ru
# * 動かせていない

# Rack3
$ cd falcon_rack3 
$ RACK_ENV=production bundle exec rackup --server falcon -p 9041 ../config.ru
```  

#### Nginx

```
$ docker run --name heade_test_nginx -v $(pwd)/nginx.conf:/etc/nginx/nginx.conf:ro -d -p 9100:80 -p 9101:81 nginx 
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →