CVE-2025-61780

Executive Summary

CVE-2025-61780 is an information disclosure vulnerability in the Rack library, a modular Ruby web server interface. The flaw resides in the Rack::Sendfile middleware, which is designed to offload file serving to a reverse proxy (e.g., Nginx) using headers like x-sendfile or x-accel-redirect. An attacker can send specially crafted x-sendfile-type and x-accel-mapping headers to the application. If the proxy does not strip these headers, Rack::Sendfile misinterprets them as proxy configuration directives, causing the proxy to reissue an internal request that bypasses its own access controls. This allows an attacker to access internal endpoints (e.g., administrative pages) that should be protected by the proxy. The vulnerability does not allow arbitrary file reads but can expose sensitive application routes.

Supply Chain & Package Security

This vulnerability affects the Ruby ecosystem via the Rack gem. Organizations using Rack-based frameworks (e.g., Ruby on Rails, Sinatra) with a proxy like Nginx that supports x-accel-redirect are at risk. The supply chain risk is moderate because the vulnerability requires specific conditions: the application must use Rack::Sendfile, the proxy must not strip the x-sendfile-type and x-accel-mapping headers, and the application must expose an endpoint returning a body responding to .to_path. The patch (versions 2.2.20, 3.1.18, 3.2.3) requires explicit configuration to enable x-accel-redirect, reducing the attack surface.

CVSS Breakdown & Threat Level

• CVSS Score: 5.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – The attack is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required beyond sending crafted headers.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited information disclosure (internal routes).
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires specific environmental conditions (proxy not stripping headers, specific application endpoint). The impact is limited to information disclosure of internal routes, which could aid further attacks.

Deep Dive & Mechanics

The Rack::Sendfile middleware is designed to improve performance by offloading file serving to a reverse proxy. When a response body responds to .to_path (e.g., a file path), Rack::Sendfile sets headers like X-Sendfile or X-Accel-Redirect to instruct the proxy to serve the file directly. The proxy then makes an internal request to the application to fetch the file.

The vulnerability arises because Rack::Sendfile trusts client-supplied headers (x-sendfile-type and x-accel-mapping) to determine how to communicate with the proxy. An attacker can send a request with:

• x-sendfile-type: x-accel-redirect – This tells Rack::Sendfile to use the x-accel-redirect mechanism.
• x-accel-mapping: /internal/ / – This maps a prefix (e.g., /internal/) to a root path (e.g., /), causing the proxy to reissue a request to an internal endpoint.

When the application returns a response with a body that has a .to_path method (e.g., a file path like /var/www/app/views/admin/dashboard.html), Rack::Sendfile sets the X-Accel-Redirect header to a path derived from the mapping. The proxy then makes a new internal request to that path, bypassing its own access controls because the internal request is not subject to the same rules as external requests.

Example Attack Flow:

1. Attacker sends a request to a public endpoint (e.g., /public/file.txt) with headers:
   • x-sendfile-type: x-accel-redirect
   • x-accel-mapping: /public/ /admin/
2. The application returns a response with a body that has .to_path returning /var/www/app/public/file.txt.
3. Rack::Sendfile sets X-Accel-Redirect: /admin/file.txt (based on the mapping).
4. The proxy (Nginx) receives this header and makes an internal request to /admin/file.txt, which is normally protected by proxy rules.
5. The attacker gains access to the admin endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Rack < 2.2.20, < 3.1.18, < 3.2.3):

# In Rack::Sendfile, the middleware trusts client-supplied headers
def call(env)
  status, headers, body = @app.call(env)
  # ...
  if body.respond_to?(:to_path)
    # Uses env['HTTP_X_SENDFILE_TYPE'] and env['HTTP_X_ACCEL_MAPPING'] directly
    sendfile_type = env['HTTP_X_SENDFILE_TYPE'] || @sendfile_type
    accel_mapping = env['HTTP_X_ACCEL_MAPPING'] || @accel_mapping
    # ...
    headers['X-Accel-Redirect'] = map_path(body.to_path, accel_mapping)
  end
  [status, headers, body]
end

Patched Code (Rack >= 2.2.20, >= 3.1.18, >= 3.2.3):

# In patched versions, client-supplied headers are ignored unless explicitly configured
def call(env)
  status, headers, body = @app.call(env)
  # ...
  if body.respond_to?(:to_path)
    # Only uses server-configured values, not client headers
    sendfile_type = @sendfile_type
    accel_mapping = @accel_mapping
    # ...
    headers['X-Accel-Redirect'] = map_path(body.to_path, accel_mapping)
  end
  [status, headers, body]
end

The patch removes the fallback to env['HTTP_X_SENDFILE_TYPE'] and env['HTTP_X_ACCEL_MAPPING'], ensuring only server-configured values are used. Additionally, x-accel-redirect must be explicitly enabled in configuration.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• Target: A Ruby on Rails application using Rack::Sendfile behind Nginx.
• Nginx config: proxy_pass http://app; with no header stripping.
• Application endpoint: /files/:filename that returns a file path.

Exploitation Steps:

1. Identify a public endpoint that returns a file path (e.g., /files/report.pdf).
2. Send a request with crafted headers:

   GET /files/report.pdf HTTP/1.1
   Host: target.com
   x-sendfile-type: x-accel-redirect
   x-accel-mapping: /files/ /admin/
   

3. The application returns a response with X-Accel-Redirect: /admin/report.pdf.
4. Nginx makes an internal request to /admin/report.pdf, bypassing access controls.
5. The attacker receives the admin page content.

Note: No public exploit code is available for this CVE.

Blue Team (Defense & Detection)

Detection:

• Monitor for requests containing x-sendfile-type or x-accel-mapping headers.
• Alert on responses with X-Accel-Redirect headers that point to internal paths (e.g., /admin/, /internal/).
• Check Nginx logs for internal requests to sensitive paths that originated from external requests.

Mitigation:

• Upgrade Rack to patched versions.
• Configure the proxy to strip x-sendfile-type and x-accel-mapping headers from incoming requests.
• In Rails applications, disable sendfile: config.action_dispatch.x_sendfile_header = nil.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with headers: x-sendfile-type: x-accel-redirect and x-accel-mapping: <mapping>.
  • HTTP responses with X-Accel-Redirect header pointing to internal paths (e.g., /admin/, /internal/).
• Log IOCs:
  • Nginx access logs showing internal requests to sensitive paths (e.g., /admin/) that were preceded by external requests with the crafted headers.
  • Application logs showing unexpected X-Accel-Redirect headers in responses.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_61780_Exploit {
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2025-61780 in Rack::Sendfile"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61780"
    strings:
        $header1 = "x-sendfile-type: x-accel-redirect" nocase
        $header2 = "x-accel-mapping:" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-61780 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with crafted x-sendfile-type and x-accel-mapping headers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.request.headers|contains:
            - 'x-sendfile-type: x-accel-redirect'
            - 'x-accel-mapping:'
    condition: selection
falsepositives:
    - Legitimate use of x-accel-redirect if configured
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61780 Rack::Sendfile Information Disclosure Attempt"; flow:to_server; content:"x-sendfile-type|3a| x-accel-redirect"; http_header; content:"x-accel-mapping|3a|"; http_header; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade Rack: Update to versions 2.2.20, 3.1.18, or 3.2.3.
2. Proxy Configuration: Configure the reverse proxy (e.g., Nginx) to strip x-sendfile-type and x-accel-mapping headers from incoming requests:

   proxy_set_header X-Sendfile-Type "";
   proxy_set_header X-Accel-Mapping "";
   

3. Disable Sendfile: In Rails applications, set config.action_dispatch.x_sendfile_header = nil in config/environments/production.rb.
4. Network Segmentation: Ensure internal endpoints are not directly accessible from the internet.
5. Monitoring: Implement detection rules (YARA, Sigma, Suricata) to alert on exploitation attempts.

Valters IT – DevSecOps & Cyber Threat Intelligence Expert