CVE-2020-25613 is a vulnerability in WEBrick, Ruby's bundled HTTP server, affecting Ruby versions up to 2.5.8, 2.6.6, and 2.7.1. It stems from insufficient validation of the transfer-encoding header, potentially enabling HTTP Request Smuggling attacks by bypassing reverse proxies. With a CVSS score of 7.5 (High), this vulnerability is network-exploitable with low attack complexity, allowing an unauthenticated attacker to achieve high integrity impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.5.8CPE matchmatch criteria | cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | ||
>= 2.6.0, <= 2.6.6CPE matchmatch criteria | cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | ||
>= 2.7.0, <= 2.7.1CPE matchmatch criteria | cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | ||
<= 1.6.0CPE matchmatch criteria | cpe:2.3:a:ruby-lang:webrick:*:*:*:*:*:ruby:*:* | ||
32CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
WEBRick vulnerable to HTTP Request/Response Smuggling
May 24, 2022An issue was discovered in Ruby through 2.5.8 2.6.x through 2.6.6 and 2.7.x through 2.7.1. WEBrick a simple HTTP server bundled with Ruby had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check) which may lead to an HTTP Request Smuggling attack.
Oct 13, 2020ruby: Potential HTTP request smuggling in WEBrick
Sep 29, 2020