Skip to content
Log inStart free trial

GHSA-vc47-6rqg-c7f5 BIT-ruby-2021-33621 BIT-ruby-min-2021-33621 CVE-2021-33621

HTTP response splitting in CGI

High RubyGems
Severity
8.8 / 10
High · CVSS 3.1
Exploit chance (EPSS)
2.45%
Chance of exploitation in the next 30 days. Higher than 84.40% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-436 Interpretation Conflict
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Fix
0.3.5
Upgrade cgi to this version or later

Description

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.

Affected versions

RubyGems

PackageVulnerableFixed in
cgi
>= 0.3.0, < 0.3.5
0.3.5
cgi
>= 0.2.0, < 0.2.2
0.2.2
cgi
< 0.1.0.2
0.1.0.2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

cgi RubyGems → 0.3.5

bundler
bundle update cgi # Gemfile: gem "cgi", ">= 0.3.5"

Severity breakdown

CVSS 3.1 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-436: Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

How to prevent it
  • Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
  • Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

References

Advisories

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-mhwm-jh88-3gjf
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement
High Also affects cgi
GHSA-gh9q-2xrm-x6qv
CGI has Denial of Service (DoS) potential in Cookie.parse
High Also affects cgi
GHSA-4vf4-qmvg-mh7h
Cookie Prefix Spoofing in CGI::Cookie.parse
High Also affects cgi
GHSA-5cqm-crxm-6qpv
Buffer overrun in CGI.escape_html
Critical Also affects cgi
GHSA-5x38-2vff-x55p
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
High Same weakness, CWE-436
GHSA-9v7c-q64q-vv33
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
Medium Same weakness, CWE-436
GHSA-pq4g-8rxf-4g29
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Medium Same weakness, CWE-436
GHSA-m665-v7pm-7grj
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Critical Same weakness, CWE-436
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor