CVE-2024-45614 — Authorization Bypass Through User-Controlled Key in Puma

CWE-639 — Authorization Bypass Through User-Controlled KeyCWE-444 — HTTP Request Smuggling10 documents7 sources
Severity
5.4MEDIUMNVD
EPSS
0.7%
top 27.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PumaDebian Puma
Timeline
PublishedSep 19
Latest updateSep 24

Description

Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NExploitability: 2.2 | Impact: 2.7

Affected Packages6 packages

▶NVDpuma/puma6.0.0 — 6.4.3+1
▶RubyGemspuma/puma6.0.0 — 6.4.3+1
▶debiandebian/puma< puma 5.6.5-3+deb12u1 (bookworm)
▶Debianpuma/puma< 4.3.8-1+deb11u3+3
▶Ubuntupuma/puma< 3.12.4-1ubuntu2+esm2+1

🔴Vulnerability Details

4
OSV
puma vulnerability↗2024-09-24
▶
GHSA
Puma's header normalization allows for client to clobber proxy set headers↗2024-09-20
▶
OSV
Puma's header normalization allows for client to clobber proxy set headers↗2024-09-20
▶
OSV
CVE-2024-45614: Puma is a Ruby/Rack web server built for parallelism↗2024-09-19
▶

📋Vendor Advisories

4
Ubuntu
Puma vulnerability↗2024-09-24
▶
Ubuntu
Puma vulnerability↗2024-09-24
▶
Red Hat
rubygem-puma: Header normalization allows for client to clobber proxy set headers↗2024-09-19
▶
Debian
CVE-2024-45614: puma - Puma is a Ruby/Rack web server built for parallelism. In affected versions clien...↗2024
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33466 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶