CVE-2025-25184
published 2025-02-12CVE-2025-25184: Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
1.14%
63.4th percentile
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby-rack | < ruby-rack 2.2.13-1~deb12u1 (bookworm) | ruby-rack 2.2.13-1~deb12u1 (bookworm) |
| rack | rack | < 2.2.11 | 2.2.11 |
| rack | rack | — | — |
| rack | rack | — | — |
| rack | rack | >= 0 < 2.2.11 | 2.2.11 |
| rack | rack | >= 3.0 < 3.0.12 | 3.0.12 |
| rack | rack | >= 3.0.0 < 3.0.12 | 3.0.12 |
| rack | rack | >= 3.1 < 3.1.10 | 3.1.10 |
| rack | rack | >= 3.1.0 < 3.1.10 | 3.1.10 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv4.05.7MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.7MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_debian5.7MEDIUM
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ruby-rack vulnerabilities
osv·2025-07-23·CVSS 5.7
CVE-2025-25184 [MEDIUM] ruby-rack vulnerabilities
ruby-rack vulnerabilities
USN-7366-1 fixed vulnerabilities in Rack. This update provides the
corresponding updates for Ubuntu 25.04.
Original advisory details:
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)
Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)
Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)
OSV
ruby-rack vulnerabilities
osv·2025-03-24·CVSS 5.7
CVE-2025-25184 [MEDIUM] ruby-rack vulnerabilities
ruby-rack vulnerabilities
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)
Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)
Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)
GHSA
Possible Log Injection in Rack::CommonLogger
ghsa·2025-02-12
CVE-2025-25184 [MEDIUM] CWE-117 Possible Log Injection in Rack::CommonLogger
Possible Log Injection in Rack::CommonLogger
## Summary
`Rack::CommonLogger` can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs.
## Details
When a user provides the authorization credentials via `Rack::Auth::Basic`, if success, the username will be put in `env['REMOTE_USER']` and later be used by `Rack::CommonLogger` for logging purposes.
The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the log
OSV
Possible Log Injection in Rack::CommonLogger
osv·2025-02-12
CVE-2025-25184 [MEDIUM] Possible Log Injection in Rack::CommonLogger
Possible Log Injection in Rack::CommonLogger
## Summary
`Rack::CommonLogger` can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs.
## Details
When a user provides the authorization credentials via `Rack::Auth::Basic`, if success, the username will be put in `env['REMOTE_USER']` and later be used by `Rack::CommonLogger` for logging purposes.
The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the log
OSV
CVE-2025-25184: Rack provides an interface for developing web applications in Ruby
osv·2025-02-12·CVSS 5.7
CVE-2025-25184 [MEDIUM] CVE-2025-25184: Rack provides an interface for developing web applications in Ruby
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2025-07-23·CVSS 6.5
CVE-2025-25184 [MEDIUM] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
USN-7366-1 fixed vulnerabilities in Rack. This update provides the
corresponding updates for Ubuntu 25.04.
Original advisory details:
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)
Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)
Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)
Instructions: In general, a standard syst
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2025-03-24·CVSS 6.5
CVE-2025-27610 [MEDIUM] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)
Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)
Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
rubygem-rack: Possible Log Injection in Rack::CommonLogger
vendor_redhat·2025-02-12·CVSS 5.7
CVE-2025-25184 [MEDIUM] CWE-117 rubygem-rack: Possible Log Injection in Rack::CommonLogger
rubygem-rack: Possible Log Injection in Rack::CommonLogger
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username wit
Debian
CVE-2025-25184: ruby-rack - Rack provides an interface for developing web applications in Ruby. Prior to ver...
vendor_debian·2025·CVSS 5.7
CVE-2025-25184 [MEDIUM] CVE-2025-25184: ruby-rack - Rack provides an interface for developing web applications in Ruby. Prior to ver...
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-02-12
Published