CVE-2026-34763

Executive Summary

CVE-2026-34763 is a moderate severity information disclosure vulnerability in the Rack Ruby web server interface. The flaw resides in the Rack::Directory middleware, which is used to generate directory listings. When the configured root path contains regex metacharacters (such as +, *, or .), the path is interpolated directly into a regular expression without proper escaping. This causes the prefix stripping logic to fail, resulting in the full filesystem path being exposed in the generated HTML output. An attacker can exploit this by simply requesting a directory listing, leading to the disclosure of sensitive system paths. The vulnerability has been patched in Rack versions 2.2.23, 3.1.21, and 3.2.6.

Supply Chain & Package Security

This vulnerability affects the Rack gem, a core component of the Ruby web ecosystem. Rack is a dependency for many Ruby web frameworks, including Ruby on Rails, Sinatra, and others. The exposure of full filesystem paths can aid attackers in reconnaissance, potentially leading to further exploitation. Organizations using Rack should prioritize updating to the patched versions to mitigate this risk.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The vulnerability is rated as Medium severity due to the low complexity of exploitation and the potential for information disclosure. While the impact is limited to confidentiality, the exposed paths can be valuable for attackers planning further attacks.

Deep Dive & Mechanics

The vulnerability exists in the Rack::Directory middleware, which is responsible for generating directory listings. When a request is made to a directory, the middleware constructs a regular expression to strip the root path from the full filesystem path, displaying only the relative path. The issue arises because the root path is interpolated directly into the regex without escaping special characters.

For example, if the root path is /var/www/+site, the + character is interpreted as a regex quantifier, causing the prefix stripping to fail. As a result, the full filesystem path (e.g., /var/www/+site/public) is exposed in the HTML output.

The vulnerable code snippet (from Rack::Directory) might look like:

def directory_listing(path)
  # ...
  regex = /^#{root}/  # root is interpolated directly
  # ...
end

The fix involves escaping regex metacharacters in the root path before interpolation:

def directory_listing(path)
  # ...
  escaped_root = Regexp.escape(root)
  regex = /^#{escaped_root}/
  # ...
end

Vulnerable vs. Patched Code

Vulnerable Code (Rack < 2.2.23, < 3.1.21, < 3.2.6):

# In Rack::Directory
def generate_listing(path)
  # ...
  regex = /^#{@root}/  # root is not escaped
  # ...
end

Patched Code (Rack >= 2.2.23, >= 3.1.21, >= 3.2.6):

# In Rack::Directory
def generate_listing(path)
  # ...
  escaped_root = Regexp.escape(@root)
  regex = /^#{escaped_root}/
  # ...
end

The patched version uses Regexp.escape to ensure that any regex metacharacters in the root path are treated as literal characters.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker needs to identify a Rack application that uses Rack::Directory with a root path containing regex metacharacters. The attacker then requests a directory listing, and the response will include the full filesystem path.

Example Exploit Request:

curl -v "http://target.com/some-directory/"

If the root path is /var/www/+site, the response might contain:

<a href="/some-directory/">/var/www/+site/some-directory/</a>

The attacker can then use this information for further reconnaissance.

Blue Team

To detect exploitation attempts, monitor for requests to directory listings that result in responses containing full filesystem paths. Additionally, review server logs for unusual patterns in the PATH_INFO or REQUEST_URI that might indicate an attempt to trigger the vulnerability.

Detection Steps:

1. Enable logging of all directory listing requests.
2. Monitor for responses that contain absolute paths (e.g., /var/www/).
3. Use the detection rules provided in the Detection Engineering section.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP responses containing full filesystem paths in directory listings (e.g., /var/www/, /home/user/).
  • Requests to directories that result in 200 responses with HTML containing absolute paths.

• File System IOCs:

  • Log entries showing directory listing requests with unusual path patterns.

• Behavioral IOCs:

  • Anomalous increase in directory listing requests from a single IP address.

Detection Engineering

YARA Rule

rule CVE_2026_34763_Rack_Directory_Info_Disclosure {
    meta:
        description = "Detects Rack::Directory responses exposing full filesystem paths"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34763"
    strings:
        $path_pattern = /\/[a-zA-Z0-9_\/\-\.\+]+/  // Match absolute paths
        $html_pattern = /<a href="[^"]*">\/[^<]+<\/a>/  // Match directory listing links
    condition:
        $html_pattern and $path_pattern
}

Sigma Rule

title: CVE-2026-34763 - Rack Directory Path Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP responses from Rack::Directory that expose full filesystem paths
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        response_body|contains: "/var/www/"
    condition: selection
falsepositives:
    - Legitimate directory listings with paths that happen to contain "/var/www/"
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-34763 - Rack Directory Path Disclosure"; flow:to_client,established; content:"/var/www/"; http_server_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions

1. Update Rack: Upgrade to versions 2.2.23, 3.1.21, or 3.2.6 or later.
2. Patch Management: Apply the patch as soon as possible, especially if Rack::Directory is used with custom root paths.

Long-Term Mitigations

1. Input Validation: Ensure that any user-controlled input used in file system operations is properly sanitized.
2. Least Privilege: Avoid exposing directory listings in production environments. Disable Rack::Directory if not needed.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests that attempt to exploit this vulnerability.
4. Regular Audits: Conduct regular security audits of dependencies and configurations.

Workarounds

If immediate patching is not possible, consider disabling Rack::Directory or using a custom middleware that escapes the root path before generating listings.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 6B358A4EA2656727851FEF20] */}