Lokale Datei-Inklusion in Rack::Static

The core of the vulnerability lies in Rack::Static's inadequate sanitization of user-supplied paths. Attackers can craft malicious requests containing encoded path traversal sequences (e.g., ../) that bypass validation and allow them to navigate the file system. This effectively grants them access to files located outside the designated static file root. The potential impact is significant, as an attacker could retrieve sensitive configuration files, source code, or other confidential data stored on the server. The blast radius extends to any application utilizing Rack::Static to serve static content, making it a widespread concern.

Applications using Rack::Static for serving static content, particularly those deployed in production environments, are at risk. Shared hosting environments where multiple applications share the same server and file system are especially vulnerable, as a compromise of one application could potentially expose files belonging to others. Legacy applications using older versions of Rack::Static are also at increased risk.

• ruby / gem: Use gem list to check for Rack::Static versions. Look for versions <= 2.2.9.

gem list rack-static

• linux / server: Examine web server access logs for requests containing path traversal sequences (e.g., ../).

grep '../' /var/log/nginx/access.log

• generic web: Use curl to attempt accessing files outside the intended static directory. If successful, the vulnerability is present.

curl http://your-server/../../../../etc/passwd

1. 2025-03-10Disclosure

   disclosure

1. Reserviert2025-03-03
2. Veröffentlicht2025-03-10
3. Geändert2026-02-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-27610 is to upgrade to Rack::Static version 2.2.13 or later, which includes the necessary fix. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by carefully validating and sanitizing all user-supplied paths before passing them to Rack::Static. This could involve implementing strict whitelisting of allowed file extensions or using a more robust path sanitization library. Additionally, review web server configurations to ensure that access to the static file root is restricted to authorized users and processes. After upgrading, confirm the fix by attempting to access files outside the intended static directory via a web browser or other HTTP client; access should be denied.