CVE-2024-35231: 
Ruby vulnerability analysis and mitigation

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not constrained to any limitation. The vulnerability was discovered and disclosed in May 2024, affecting all versions up to 2.4 (GitHub Advisory).

The vulnerability stems from unconstrained user input in the profiler_runs parameter, which could lead to unlimited resource allocation on the server side. The vulnerability is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS v3.1 score is 8.6 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (GitHub Advisory).

The vulnerability could lead to resource exhaustion through remotely controlled values, potentially causing a denial of service condition. An attacker could exploit this by sending requests with extremely large values for the profiler_runs parameter, causing the server to allocate excessive resources (GitHub Advisory).

The vulnerability is easily exploitable through HTTP requests. A proof of concept exists where an attacker can trigger the vulnerability using a simple curl command: curl "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" (GitHub Advisory).

The vulnerability has been patched in version 2.5.0 of rack-contrib. The fix implements a maximum limit on the number of profiler runs to prevent resource exhaustion. Users should upgrade to version 2.5.0 or later to address this vulnerability (GitHub Commit).