CVE-2025-27221

Executive Summary

CVE-2025-27221 is a low-severity information disclosure vulnerability in the Ruby URI gem (versions before 1.0.3). The flaw allows authentication credentials (userinfo) to be inadvertently leaked when using URI manipulation methods such as URI.join, URI#merge, and URI#+. Specifically, when a URI containing userinfo (e.g., http://user:pass@host1/path) is merged with another URI that changes the host (e.g., http://host2/newpath), the resulting URI incorrectly retains the original userinfo. This can lead to credential leakage if the resulting URI is logged, transmitted, or displayed.

Supply Chain & Package Security

This vulnerability affects the Ruby ecosystem via the uri gem, which is a default gem bundled with Ruby. The gem is widely used in web applications, API clients, and network libraries. An attacker could exploit this in supply chain attacks by crafting malicious URIs that cause credential leakage in downstream applications. The patch is available in version 1.0.3, and all Ruby users should update their uri gem.

CVSS Breakdown & Threat Level

• CVSS Score: 3.2 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (credential leakage)
• Integrity Impact: None
• Availability Impact: None

The low score reflects the limited impact (credential leakage) and the specific conditions required for exploitation (use of vulnerable URI methods with userinfo).

Deep Dive & Mechanics

The vulnerability lies in the URI.join, URI#merge, and URI#+ methods. When combining two URIs, the gem incorrectly preserves the userinfo component from the base URI even when the host is changed. For example:

base = URI.parse("http://user:pass@host1/path")
result = URI.join(base, "http://host2/newpath")
# Result: http://user:pass@host2/newpath (userinfo leaked)

The expected behavior is that when the host changes, the userinfo should be discarded because the credentials are specific to the original host. The root cause is a missing check in the URI merging logic that fails to clear the userinfo field when the host component is replaced.

Vulnerable vs. Patched Code

Vulnerable Code (URI gem < 1.0.3):

# In URI::Generic#merge
def merge(oth)
  # ...
  if oth.host
    self.userinfo = self.userinfo  # Incorrectly retains userinfo
    self.host = oth.host
  end
  # ...
end

Patched Code (URI gem >= 1.0.3):

# In URI::Generic#merge
def merge(oth)
  # ...
  if oth.host
    self.userinfo = nil  # Correctly clears userinfo
    self.host = oth.host
  end
  # ...
end

The fix ensures that when the host is changed, the userinfo is set to nil, preventing credential leakage.

Exploitation & Lab Setup

Red Team

1. Setup: Use Ruby 2.7 or 3.0 with URI gem < 1.0.3.
2. Exploit: Craft a malicious URI with userinfo and use URI.join to change the host.
3. Example:

   require 'uri'
   base = URI.parse("http://admin:secret@evil.com/path")
   result = URI.join(base, "http://legitimate.com/newpath")
   puts result.to_s  # Outputs: http://admin:secret@legitimate.com/newpath
   

4. Impact: The credentials admin:secret are now associated with legitimate.com, potentially leaking them in logs or HTTP requests.

Blue Team

1. Detection: Monitor for URIs containing @ symbols in logs, especially after URI manipulation.
2. Mitigation: Update the uri gem to version 1.0.3 or later.
3. Workaround: Manually clear userinfo before merging:

   base.userinfo = nil
   result = URI.join(base, "http://legitimate.com/newpath")
   

Indicators of Compromise (IOCs)

• Log Entries: URIs containing user:pass@ in application logs.
• Network Traffic: HTTP requests with Authorization headers containing leaked credentials.
• File Hashes: Vulnerable gem files (e.g., uri-0.10.0.gem).
• Processes: Ruby processes using URI.join, URI#merge, or URI#+ with userinfo.

Detection Engineering

YARA Rule

rule CVE_2025_27221_URI_Leak {
    meta:
        description = "Detects vulnerable URI gem versions"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-27221"
    strings:
        $vuln_code = /self\.userinfo\s*=\s*self\.userinfo/
    condition:
        $vuln_code
}

Sigma Rule

title: CVE-2025-27221 URI Credential Leakage
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential credential leakage via URI manipulation
logsource:
    category: application
    product: ruby
detection:
    selection:
        EventID: 1001
        Message|contains: "user:pass@"
    condition: selection
falsepositives:
    - Legitimate use of credentials in URIs
level: low

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-27221 URI Credential Leakage";
    flow:to_server,established;
    content:"@"; http_uri;
    pcre:"/[a-zA-Z0-9]+:[a-zA-Z0-9]+@/";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Upgrade the uri gem to version 1.0.3 or later:

   gem update uri
   

2. Workaround: If upgrade is not possible, manually clear userinfo before URI manipulation:

   base.userinfo = nil
   

3. Code Review: Audit all uses of URI.join, URI#merge, and URI#+ in your codebase.
4. Logging: Sanitize URIs in logs to remove userinfo.
5. Monitoring: Implement detection rules to alert on credential leakage.

Valters IT signature: This report is generated for educational and defensive purposes. Always verify with official sources.