CVE-2025-61780

A potential information disclosure vulnerability has been identified in the RubyGem Rack affecting Rack::Sendfile when used behind a proxy that supports x-sendfile headers (e.g., Nginx). When processing untrusted x-sendfile-type or x-accel-mapping headers, the middleware could misinterpret them as proxy directives, causing the proxy to make unintended internal requests. An attacker could exploit this by sending crafted headers and requesting paths that trigger proxy-based acceleration, potentially accessing internal application endpoints that are normally protected. The issue does not allow arbitrary file reads, code execution, or denial of service.

This vulnerability is classified as Moderate severity primarily because exploitation requires a specific deployment scenario meeting all of the following conditions:

• The application must use Rack::Sendfile behind a proxy that supports x-accel-redirect (eg. Nginx)

• The proxy must not consistently set or remove the relevant x-sendfile-type and x-accel-mapping headers

• The application must expose endpoints returning objects responding to .to_path.

Exploitation could allow attackers to bypass proxy-enforced access controls and reach internal routes.

CVSS Assessment:

Scope (S:C): Changed — the attack affects the proxy's interpretation of internal routes, which is outside the original application scope.

Confidentiality (C:L): Low — attacker can only see internal endpoints, but does not allow arbitrary file access or sensitive data exposure.

Affectedness:

Ruby 2.x and 3.x versions shipped with Red Hat Enterprise Linux, Red Hat Openshift Core OS (RHOCS) and Red Hat In-Vehicle OS (RHIVOS) are not affected, as they do not bundle the rack RubyGem by default. Rack is a third-party gem that must be installed separately.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.