Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
GHSA-8cgq-6mh2-7j6v · CVE-2025-27111
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Summary
Rack::Sendfile can be exploited by crafting input that includes newline characters to manipulate log entries.
Details
The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection.
Impact
This vulnerability can distort log files, obscure attack traces, and complicate security auditing.
Mitigation
- Update to the latest version of Rack, or
- Remove usage of
Rack::Sendfile.
References
- WEB https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-27111
- WEB https://github.com/rack/rack/commit/803aa221e8302719715e224f4476e438f2531a53
- WEB https://github.com/rack/rack/commit/aeac570bb8080ca7b53b7f2e2f67498be7ebd30b
- WEB https://github.com/rack/rack/commit/b13bc6bfc7506aca3478dc5ac1c2ec6fc53f82a3
- PACKAGE https://github.com/rack/rack
- WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-27111.yml
- WEB https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html
Ready to move
Start Securing
Free, no credit card | First findings in minutes