Platform
ruby
Component
puma
Fixed in
3.12.5
4.0.1
3.12.4
CVE-2020-5249 describes a HTTP Response Splitting vulnerability within Puma, a Ruby web server. This flaw allows attackers to inject malicious content into HTTP responses by manipulating early-hints headers, potentially leading to cross-site scripting (XSS) attacks. The vulnerability impacts Puma versions 3.9.1 and earlier, and a fix is available in version 3.12.4.
The core of this vulnerability lies in Puma's handling of early-hints headers. If an application using Puma accepts untrusted input within these headers, a malicious actor can exploit this by injecting a carriage return character. This effectively terminates the header prematurely, allowing the attacker to inject arbitrary content, such as additional headers or even a completely new response body. While not a direct attack vector itself, HTTP Response Splitting serves as a foundation for numerous other attacks. The most common consequence is cross-site scripting (XSS), where injected scripts can compromise user sessions and steal sensitive data. Furthermore, response splitting can be leveraged for cache poisoning, session hijacking, and other malicious activities, significantly expanding the potential blast radius of this vulnerability.
CVE-2020-5249 is related to CVE-2020-5247, highlighting a broader issue in Puma's header handling. While no active exploitation campaigns have been publicly reported, the vulnerability's potential for XSS and other attacks makes it a worthwhile target. The vulnerability was publicly disclosed on March 3, 2020. No KEV listing or public proof-of-concept has been identified as of the current date.
Exploit Status
EPSS
0.50% (66% percentile)
CVSS Vector
The primary mitigation for CVE-2020-5249 is to upgrade Puma to version 3.12.4 or later, which includes the necessary fix. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by sanitizing or validating early-hints headers to prevent carriage return characters from being included. Web application firewalls (WAFs) can also be configured to filter out suspicious early-hints headers. Additionally, review application code to ensure that any user-supplied data included in HTTP headers is properly escaped to prevent injection attacks. After upgrading, confirm the fix by sending a request with a crafted early-hints header containing a carriage return and verifying that the response does not contain the injected content.
Update the Puma gem to version 4.3.3 or higher, or to version 3.12.4 or higher. This will correct the HTTP response splitting vulnerability. Run `gem update puma` to update.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2020-5249 is a vulnerability in Puma versions 3.9.1 and earlier that allows attackers to inject malicious content into HTTP responses via early-hints headers, potentially leading to XSS.
You are affected if you are using Puma versions 3.9.1 or earlier. Upgrade to version 3.12.4 or later to resolve the issue.
Upgrade Puma to version 3.12.4 or later. If an immediate upgrade isn't possible, sanitize early-hints headers and consider using a WAF.
While no active exploitation campaigns have been publicly reported, the vulnerability's potential for XSS makes it a potential target.
Refer to the Puma security advisory on GitHub: https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your Gemfile.lock file and we'll tell you instantly if you're affected.