Rack::Static 中的本地文件包含 (Local File Inclusion)

该漏洞的潜在影响非常严重。攻击者可以利用此漏洞访问服务器上的任何文件，只要这些文件位于 root: 目录之下。这可能包括配置文件、数据库凭证、源代码和其他敏感信息。攻击者可以利用这些信息进行进一步的攻击，例如数据泄露、权限提升或远程代码执行。由于 Rack 广泛应用于 Ruby Web 应用程序中，因此该漏洞的潜在影响范围非常广。

Applications using Rack::Static for serving static content, particularly those deployed in production environments, are at risk. Shared hosting environments where multiple applications share the same server and file system are especially vulnerable, as a compromise of one application could potentially expose files belonging to others. Legacy applications using older versions of Rack::Static are also at increased risk.

• ruby / gem: Use gem list to check for Rack::Static versions. Look for versions <= 2.2.9.

gem list rack-static

• linux / server: Examine web server access logs for requests containing path traversal sequences (e.g., ../).

grep '../' /var/log/nginx/access.log

• generic web: Use curl to attempt accessing files outside the intended static directory. If successful, the vulnerability is present.

curl http://your-server/../../../../etc/passwd

1. 2025-03-10Disclosure

   disclosure

1. 已保留2025-03-03
2. 发布日期2025-03-10
3. 修改日期2026-02-04
4. EPSS 更新日期2026-04-02

最有效的缓解措施是升级至 Rack 2.2.13 或更高版本，该版本修复了此漏洞。如果无法立即升级，可以考虑以下临时缓解措施：限制 root: 目录的访问权限，确保其只允许授权用户访问。实施严格的文件访问控制策略，防止未经授权的文件访问。使用 Web 应用防火墙 (WAF) 过滤掉包含路径遍历序列的请求。监控 Rack 应用程序的日志，查找可疑活动。