Rack has a Possible Information Disclosure Vulnerability

The core of this vulnerability lies in Rack's handling of x-sendfile-type and x-accel-mapping headers. When these headers, typically used for proxy acceleration, are received from an untrusted source (e.g., a client), Rack incorrectly interprets them as proxy configuration directives. This misinterpretation allows an attacker to manipulate Rack's behavior, causing it to send redirect responses to internal resources that would normally be protected by the proxy. The potential impact includes unauthorized access to sensitive data or internal services that are not directly exposed to the internet. While not a direct remote code execution (RCE) vulnerability, the ability to bypass proxy restrictions can significantly expand an attacker's reach within a network.

Applications and services relying on the Rack library and deployed behind proxy servers (e.g., Nginx, Apache) are at risk. This includes Ruby on Rails applications and other web frameworks that utilize Rack. Shared hosting environments where Rack is used and proxy configurations are not fully controlled by the application developer are particularly vulnerable.

• ruby / server:

  grep -r 'x-sendfile-type' /var/log/nginx/access.log
  grep -r 'x-accel-mapping' /var/log/apache2/access.log

• generic web:

  curl -I <target_url> | grep 'x-sendfile-type'
  curl -I <target_url> | grep 'x-accel-mapping'

1. 2025-10-10Disclosure

   disclosure

1. आरक्षित2025-09-30
2. प्रकाशित2025-10-10
3. संशोधित2026-02-04
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-61780 is to upgrade to Rack version 2.2.20 or later, which includes the fix for this information disclosure vulnerability. If upgrading is not immediately feasible, consider implementing stricter input validation on the proxy server to sanitize or reject potentially malicious x-sendfile headers. Web application firewalls (WAFs) configured to inspect and filter HTTP headers can also provide a layer of defense. Monitor proxy access logs for unusual redirect patterns or requests to internal resources. After upgrading, confirm the fix by sending a crafted x-sendfile header and verifying that Rack no longer attempts to send an internal redirect.