[CVE-2022-44572] Possible Denial of Service Vulnerability in Rack’s RFC2183 boundary parsing

Disclosed: 2023-07-27 07:09:44 By ooooooo_q To ibb
Low
Vulnerability Details
I reported at https://hackerone.com/reports/1639882 https://discuss.rubyonrails.org/t/cve-2022-44572-possible-denial-of-service-vulnerability-in-racks-rfc2183-boundary-parsing/82124 > There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572. > Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. ## Impact Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. This regular expression does not have the effect of ReDoS countermeasures using memoization in Ruby 3.2.
Actions
View on HackerOne
Report Stats
  • Report ID: 2012125
  • State: Closed
  • Substate: resolved
  • Upvotes: 2
Share this report