Overview
Rack provides an interface for developing web applications in Ruby. A vulnerability was identified in the Rack::CommonLogger component, where attackers can exploit CRLF injection to manipulate log entries. This issue is prevalent when usernames containing CRLF characters are logged, which can break log formats or insert fraudulent entries. This affects versions before 2.2.11, 3.0.12, and 3.1.10.
Details
Module Info
Product: Rack
Affected packages: rack
Affected versions: <2.2.11, <3.0.12, <3.1.10
Github repository: https://github.com/rack/rack
Published packages: https://rubygems.org/gems/rack
Package manager: RubyGems
Fixed in: Rack v2.2.11, v3.0.12, v3.1.10
Vulnerability Info
CVE-2025-25184 is a medium-severity vulnerability in Rack::CommonLogger, affecting versions before 2.2.11, 3.0.12, and 3.1.10. It allows CRLF characters to be injected into log entries via malicious usernames, potentially obscuring real activities or injecting malicious data into log files. The issue occurs when the application logs usernames containing CRLF characters, which can manipulate the log format.
Steps To Reproduce
1. Set up a Rack application using an affected version. 2. Create a user with a username containing CRLF characters. 3. Log in using this username. 4. Observe the log entries to see if the malicious username affects the log format.
Credit
HexSave
Mitigation
Upgrade to Rack versions 2.2.11, 3.0.12, or 3.1.10 where the issue is fixed. If an upgrade is not possible, consider using a commercial support partner like HeroDevs to implement a custom logging solution that sanitizes log inputs.
