CVE-2026-34830

Executive Summary

CVE-2026-34830 is a high-severity vulnerability in the Rack Ruby web server interface, specifically within the Rack::Sendfile middleware. The flaw allows an attacker to inject regex metacharacters via the X-Accel-Mapping request header, leading to arbitrary file reads from nginx internal locations when x-accel-redirect is used. This can result in unauthorized access to sensitive files such as configuration files, source code, or private data. The vulnerability has been patched in Rack versions 2.2.23, 3.1.21, and 3.2.6. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability affects the Rack gem, a critical component of the Ruby web application stack. Organizations using Ruby on Rails or other Rack-based frameworks must ensure their Gemfile specifies a patched version. Supply chain risk is elevated because Rack is a transitive dependency for many Ruby applications, and unpatched versions can be unknowingly included. Developers should audit their Gemfile.lock for affected versions and update immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the low complexity and network-based attack vector, but the impact is limited to low confidentiality and integrity loss. However, in specific deployments where nginx serves sensitive internal files, the actual risk can be higher.

Deep Dive & Mechanics

The vulnerability resides in the Rack::Sendfile#map_accel_path method. This method is responsible for translating file paths from the backend to nginx's X-Accel-Redirect header. It uses the X-Accel-Mapping header provided by the client to perform a regex-based substitution.

Vulnerable Code Flow:

1. The client sends a request with an X-Accel-Mapping header.
2. Rack::Sendfile reads this header and uses it to construct a regex pattern.
3. The regex is applied to the file path to generate the X-Accel-Redirect response header.
4. Because the header value is not escaped, an attacker can inject regex metacharacters (e.g., .*, ^, $) to manipulate the regex behavior.
5. This allows the attacker to control the resulting X-Accel-Redirect path, potentially pointing nginx to arbitrary internal files.

Example Attack: If the backend expects a mapping like /internal/ /public/, an attacker could send X-Accel-Mapping: /internal/(.*) /public/ to match any path under /internal/. By injecting .*, they could read files outside the intended directory.

Vulnerable vs. Patched Code

Vulnerable Code (Rack < 2.2.23, < 3.1.21, < 3.2.6):

def map_accel_path(env, path)
  if mapping = env['HTTP_X_ACCEL_MAPPING']
    mapping.scan(/([^\s]+)\s+([^\s]+)/).each do |internal, external|
      path.sub!(internal, external)
    end
  end
  path
end

Patched Code (Rack >= 2.2.23, >= 3.1.21, >= 3.2.6):

def map_accel_path(env, path)
  if mapping = env['HTTP_X_ACCEL_MAPPING']
    mapping.scan(/([^\s]+)\s+([^\s]+)/).each do |internal, external|
      escaped_internal = Regexp.escape(internal)
      path.sub!(escaped_internal, external)
    end
  end
  path
end

The fix uses Regexp.escape to escape all regex metacharacters in the internal string before using it in the substitution, preventing injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Rack application behind nginx with x-accel-redirect enabled.
2. Configure nginx to serve files from an internal location (e.g., /internal/).
3. Ensure the Rack application uses Rack::Sendfile middleware.

Exploitation Steps:

1. Send a request with a crafted X-Accel-Mapping header:

   GET /some/path HTTP/1.1
   Host: target.com
   X-Accel-Mapping: /internal/(.*) /public/
   

2. The backend will generate an X-Accel-Redirect header pointing to /public/ followed by the captured group.
3. By manipulating the regex, an attacker can read arbitrary files:

   X-Accel-Mapping: /internal/(.*) /etc/passwd
   

   This could cause nginx to serve /etc/passwd if the path matches.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for requests containing X-Accel-Mapping headers with unusual patterns (e.g., regex metacharacters like .*, ^, $, (, )).
• Alert on X-Accel-Redirect response headers pointing to unexpected paths (e.g., /etc/, /proc/, /var/log/).

Prevention:

• Apply the patch immediately.
• Use a Web Application Firewall (WAF) to block requests with suspicious X-Accel-Mapping headers.
• Restrict nginx internal locations to only necessary directories.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with X-Accel-Mapping header containing regex metacharacters.
  • HTTP responses with X-Accel-Redirect header pointing to sensitive files (e.g., /etc/passwd, /proc/self/environ).
• Logs:
  • Nginx access logs showing X-Accel-Redirect to unusual paths.
  • Application logs showing unexpected file path substitutions.
• File System:
  • Unauthorized access to files outside the intended internal location.

Detection Engineering

YARA Rule

rule CVE_2026_34830_Rack_Sendfile_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2026-34830 via X-Accel-Mapping header"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $header = "X-Accel-Mapping" nocase
        $regex_chars = /[.*+?^${}()|\[\]\\]/
    condition:
        $header and #regex_chars > 2
}

Sigma Rule

title: CVE-2026-34830 - Rack Sendfile X-Accel-Mapping Injection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with suspicious X-Accel-Mapping headers indicating regex injection attempts.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.request.headers|contains: 'X-Accel-Mapping'
        http.request.headers|re: '.*[.*+?^${}()|\[\]\\].*'
    condition: selection
falsepositives:
    - Legitimate use of regex in X-Accel-Mapping (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-34830 Rack Sendfile X-Accel-Mapping Injection"; flow:to_server; http.header; content:"X-Accel-Mapping"; nocase; pcre:"/.*[.*+?^${}()|\[\]\\].*/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update Rack to version 2.2.23, 3.1.21, or 3.2.6 or later.
2. Workaround: If patching is not possible, disable Rack::Sendfile middleware or validate the X-Accel-Mapping header to reject regex metacharacters.
3. Nginx Configuration: Restrict internal locations to only necessary directories and avoid using user-controlled paths.
4. WAF Rules: Block requests with X-Accel-Mapping headers containing regex metacharacters.
5. Monitoring: Enable logging of X-Accel-Redirect headers and alert on unusual paths.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 06C02F596C9072CCDDE1800F] */}