CVE-2026-34785

Executive Summary

CVE-2026-34785 is a vulnerability in the Rack Ruby web server interface, specifically within the Rack::Static middleware. The flaw arises from a simplistic string prefix check used to determine if a request should be served as a static file. When Rack::Static is configured with URL prefixes like /css, it matches any request path that begins with that string, including unrelated paths such as /css-config.env or /css-backup.sql. This can lead to unintended disclosure of sensitive files located under the static root directory that merely share the configured prefix.

The vulnerability has a CVSS score of 7.5 (High) and is classified under CWE-200 (Information Exposure). The EPSS score is 0.0%, indicating low exploitation probability at the time of analysis. Patches are available in versions 2.2.23, 3.1.21, and 3.2.6.

Supply Chain & Package Security

This vulnerability affects the Rack gem, a core component of the Ruby ecosystem. Applications using Rack as their web server interface are at risk if they rely on Rack::Static for serving static files. The supply chain risk is moderate, as the vulnerability is in a widely used library. Developers should ensure they are using patched versions and review their static file serving configurations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the ease of exploitation and potential for information disclosure. An attacker can send crafted requests to access sensitive files without authentication.

Deep Dive & Mechanics

The vulnerability resides in the Rack::Static middleware, which is used to serve static files from a specified root directory. The middleware checks if the request path starts with a configured URL prefix (e.g., /css). However, this check is performed using a simple string prefix match, without verifying that the path is exactly the intended directory or file.

For example, if the configuration is:

use Rack::Static, urls: ["/css"], root: "public"

Then a request to /css-config.env will be matched because it starts with /css. The middleware will then attempt to serve the file public/css-config.env if it exists. This can expose configuration files, backups, or other sensitive data.

The fix involves implementing a more robust path matching mechanism that ensures the request path corresponds to an actual file or directory under the configured prefix, rather than just a string prefix match.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

def call(env)
  path = env["PATH_INFO"]
  @urls.each do |url|
    if path.start_with?(url)
      # Serve static file
      return serve_file(env)
    end
  end
  @app.call(env)
end

Patched Code (simplified):

def call(env)
  path = env["PATH_INFO"]
  @urls.each do |url|
    if path == url || path.start_with?(url + "/")
      # Serve static file
      return serve_file(env)
    end
  end
  @app.call(env)
end

The patched version ensures that the path either exactly matches the URL prefix or is followed by a /, preventing matches like /css-config.env.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can send HTTP requests with paths that start with the configured prefix but point to unintended files.

Example Request:

GET /css-config.env HTTP/1.1
Host: target.com

If the server has a file public/css-config.env, it will be served. Attackers can enumerate potential files by guessing common names.

Lab Setup:

1. Install a vulnerable version of Rack (e.g., 2.2.22).
2. Create a simple Rack application with Rack::Static configured:

   use Rack::Static, urls: ["/css"], root: "public"
   run lambda { |env| [200, {"Content-Type" => "text/plain"}, ["Hello"]] }
   

3. Place a sensitive file in the public directory, e.g., public/css-config.env.
4. Start the server and send a request to /css-config.env.

Blue Team

Detection:

• Monitor for requests to paths that are variations of configured static prefixes (e.g., /css-*, /js-*).
• Look for unusual file extensions or patterns in static file requests.

Prevention:

• Update Rack to patched versions (2.2.23, 3.1.21, 3.2.6).
• Implement additional access controls on static directories.
• Use a reverse proxy with strict path matching.

Indicators of Compromise (IOCs)

• Network: HTTP requests with paths like /css-config.env, /css-backup.sql, /js-config.json, etc.
• File System: Unexpected access to files under the static root that share prefixes with configured URLs.
• Logs: Server logs showing 200 responses for paths that are not standard static files.

Detection Engineering

YARA Rule

rule CVE_2026_34785_Rack_Static_Info_Disclosure {
    meta:
        description = "Detects attempts to exploit CVE-2026-34785 in Rack::Static"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34785"
    strings:
        $prefix1 = "/css" ascii wide nocase
        $prefix2 = "/js" ascii wide nocase
        $prefix3 = "/images" ascii wide nocase
        $sensitive_ext = ".env" ascii wide nocase
        $sensitive_ext2 = ".sql" ascii wide nocase
        $sensitive_ext3 = ".json" ascii wide nocase
    condition:
        any of ($prefix*) and any of ($sensitive_ext*)
}

Sigma Rule

title: CVE-2026-34785 Rack Static Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests exploiting CVE-2026-34785 to access unintended files
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/css-'
            - '/js-'
            - '/images-'
    condition: selection
falsepositives:
    - Legitimate files with similar names
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-34785 Rack Static Path Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/css-"; http_uri; nocase; content:".env"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update Rack to version 2.2.23, 3.1.21, or 3.2.6.
2. Configuration Review: Ensure Rack::Static is configured with specific file patterns rather than broad prefixes.
3. Access Controls: Implement additional authentication or authorization for sensitive static files.
4. Monitoring: Enable logging and monitoring for unusual static file requests.
5. WAF Rules: Deploy web application firewall rules to block requests with suspicious path patterns.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 4A38BE935F112966BB55D235] */}