Puma's header normalization allows for client to clobber proxy set headers

The core of this vulnerability lies in Puma's handling of headers with underscores. An attacker can submit a header like X-Forwarded_For alongside the standard X-Forwarded-For. Puma, in vulnerable versions, will incorrectly process the underscored version, potentially overriding headers set by a proxy server. This manipulation can be leveraged to downgrade connections from HTTPS to HTTP, effectively stripping away encryption and exposing sensitive data in transit. Furthermore, attackers could redirect responses, potentially leading to phishing or other malicious actions, especially when combined with a man-in-the-middle (MITM) attack. The blast radius extends to any application relying on Puma and trusting headers provided by upstream proxies.

1. 已保留2024-09-02
2. 发布日期2024-09-20
3. 修改日期2026-02-04
4. EPSS 更新日期2026-04-02

The primary mitigation is to upgrade to Puma version 5.6.9 or later, which correctly discards underscored header versions when the standard version is also present. If upgrading is not immediately feasible, a workaround involves configuring the upstream proxy (e.g., Nginx) to prioritize its headers. This can be achieved by ensuring that the proxy is the sole source of headers like X-Forwarded-For and that Puma is not configured to override them. Specifically, ensure Nginx is configured to send headers with a higher precedence. After upgrading, confirm the fix by sending requests with both X-Forwarded-For and X-Forwarded_For headers and verifying that the proxy-defined header is used.