CVE-2026-32762

Executive Summary

CVE-2026-32762 is a medium-severity vulnerability in the Rack Ruby web server interface, affecting versions 3.0.0.beta1 through 3.1.20 and 3.2.0 through 3.2.5. The flaw resides in the Rack::Utils.forwarded_values method, which incorrectly parses the RFC 7239 Forwarded header by splitting on semicolons without properly handling quoted-string values. Since quoted values can legally contain semicolons, an attacker can craft a header that Rack interprets as multiple directives, while an upstream proxy or WAF sees a single, valid value. This discrepancy enables HTTP request smuggling, allowing an attacker to manipulate the host, proto, for, or by parameters.

The vulnerability has a CVSS score of 4.8 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. Patches are available in Rack 3.1.21 and 3.2.6.

Supply Chain & Package Security

Rack is a critical dependency in the Ruby ecosystem, serving as the foundation for frameworks like Ruby on Rails, Sinatra, and many others. This vulnerability is distributed via the rack gem on RubyGems. Organizations should verify their Gemfile.lock for affected versions and update immediately. Supply chain risk is elevated due to Rack's widespread use; a compromised or vulnerable Rack installation can affect thousands of downstream applications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for request smuggling in a widely-used web server interface warrants attention. The low EPSS score suggests limited active exploitation, but the attack complexity is low, and no authentication is required.

Deep Dive & Mechanics

The vulnerability is rooted in the Rack::Utils.forwarded_values method, which parses the Forwarded HTTP header as defined in RFC 7239. The RFC specifies that the header value consists of a list of directives separated by semicolons, but quoted-string values (e.g., for="192.0.2.43:8080;proto=http") may contain semicolons as part of the value. Rack's implementation naively splits the entire header on semicolons before handling quoted strings, leading to incorrect parsing.

Attack Scenario: An attacker sends a request with a crafted Forwarded header:

Forwarded: for="192.0.2.43:8080;proto=http"

An upstream proxy or WAF that correctly parses RFC 7239 sees this as a single for directive with a quoted value containing a semicolon. However, Rack's flawed parser splits on the semicolon, interpreting it as two directives:

• for="192.0.2.43:8080"
• proto=http

This allows the attacker to smuggle a proto directive, potentially overriding the protocol scheme (e.g., forcing http instead of https). Similarly, host, by, and other parameters can be injected.

Impact:

• Host Smuggling: Redirect traffic to malicious hosts.
• Protocol Downgrade: Force HTTP instead of HTTPS, enabling man-in-the-middle attacks.
• For/By Spoofing: Bypass IP-based access controls or logging.

Vulnerable vs. Patched Code

Vulnerable Code (Rack < 3.1.21, < 3.2.6):

# lib/rack/utils.rb
def self.forwarded_values(env)
  # ...
  values = env['HTTP_FORWARDED'].split(';').map(&:strip)
  # ...
end

Patched Code (Rack >= 3.1.21, >= 3.2.6):

# lib/rack/utils.rb
def self.forwarded_values(env)
  # ...
  values = parse_forwarded_header(env['HTTP_FORWARDED'])
  # ...
end

def self.parse_forwarded_header(header)
  # Properly handle quoted strings with semicolons
  tokens = []
  current = ""
  in_quote = false
  header.each_char do |c|
    if c == '"'
      in_quote = !in_quote
      current << c
    elsif c == ';' && !in_quote
      tokens << current.strip
      current = ""
    else
      current << c
    end
  end
  tokens << current.strip unless current.empty?
  tokens
end

The patch introduces a stateful parser that tracks whether the parser is inside a quoted string, preventing semicolons within quotes from being treated as delimiters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Rack 3.0.0.beta1 to 3.1.20 or 3.2.0 to 3.2.5.
• An upstream proxy or WAF that correctly handles RFC 7239 Forwarded headers.

Exploit Steps:

1. Identify a target application using Rack (e.g., Ruby on Rails).
2. Send a crafted HTTP request with a malicious Forwarded header:

   GET / HTTP/1.1
   Host: vulnerable-app.com
   Forwarded: for="192.168.1.1;proto=http"
   

3. If the upstream proxy validates the header as a single for directive, it passes the request. Rack's flawed parser splits it into for="192.168.1.1" and proto=http, overriding the protocol.
4. Observe the application behavior: if it trusts the proto directive, it may treat the request as HTTP, potentially leaking sensitive data or bypassing HTTPS enforcement.

Example using curl:

curl -H 'Forwarded: for="192.168.1.1;proto=http"' http://vulnerable-app.com/

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual Forwarded headers containing semicolons within quoted values.
• Log and alert on discrepancies between upstream proxy parsing and application-level parsing.

Defense:

• Apply the patch immediately (upgrade to Rack 3.1.21 or 3.2.6).
• If patching is delayed, implement a WAF rule to reject Forwarded headers with semicolons inside quoted strings.
• Validate the Forwarded header at the application level using a compliant parser.

Lab Setup:

1. Deploy a vulnerable Rack application (e.g., a simple Sinatra app) using Docker:

   FROM ruby:3.0
   RUN gem install rack -v 3.0.0.beta1
   COPY app.rb /app.rb
   CMD ["ruby", "/app.rb"]
   

2. Set up an upstream proxy (e.g., Nginx) that correctly parses RFC 7239.
3. Send exploit requests and observe the behavior.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with Forwarded headers containing semicolons inside quoted values (e.g., for="value;proto=http").
  • Anomalous Forwarded headers with multiple directives that appear to be split from a single quoted value.

• Log IOCs:

  • Application logs showing unexpected Forwarded header values (e.g., for="192.168.1.1" and proto=http in separate entries).
  • Proxy logs showing a single Forwarded header, but application logs showing multiple directives.

• File IOCs:

  • Presence of vulnerable Rack gem versions in Gemfile.lock:

    rack (3.0.0.beta1, 3.0.1, ..., 3.1.20, 3.2.0, ..., 3.2.5)
    

Detection Engineering

YARA Rule

rule CVE_2026_32762_Rack_Forwarded_Smuggling {
    meta:
        description = "Detects vulnerable Rack versions based on Forwarded header parsing"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-32762"
    strings:
        $vuln_method = "forwarded_values" ascii wide nocase
        $vuln_split = ".split(';')" ascii wide nocase
        $vuln_gem = /rack\s*\([^)]*3\.[012]\.[0-9]+[^)]*\)/ nocase
    condition:
        ($vuln_method and $vuln_split) or $vuln_gem
}

Sigma Rule

title: CVE-2026-32762 - Rack Forwarded Header Smuggling
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with Forwarded headers containing semicolons inside quoted values, indicating potential exploitation of CVE-2026-32762.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.request.headers.Forwarded|contains: ';'
        http.request.headers.Forwarded|contains: '"'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in quoted Forwarded values (rare)
level: medium
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.32762

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-32762 - Rack Forwarded Header Smuggling Attempt"; flow:to_server; http.header_names; content:"Forwarded"; http.header_raw; content:"\";"; distance:0; within:100; pcre:"/Forwarded\s*:\s*[^\r\n]*\"[^\"]*;/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Rack to version 3.1.21 or 3.2.6 (or later).

   gem update rack
   

2. Verify: Check Gemfile.lock for affected versions and run bundle update rack.

Mitigation (if patching is delayed):

• Deploy a WAF rule to reject Forwarded headers containing semicolons inside quoted strings.
• Implement a custom middleware to re-parse the Forwarded header correctly:

  class ForwardedSanitizer
    def initialize(app)
      @app = app
    end
  
    def call(env)
      if env['HTTP_FORWARDED']
        # Reject if semicolon inside quotes
        if env['HTTP_FORWARDED'] =~ /"[^"]*;/
          return [400, {}, ["Bad Request"]]
        end
      end
      @app.call(env)
    end
  end
  

Long-term:

• Conduct a code review of all custom header parsing logic.
• Implement fuzz testing for HTTP header parsing.
• Monitor for similar vulnerabilities in other Ruby gems.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: E223524115C7961059C6EC13] */}