CVE-2025-61780: 
Ruby vulnerability analysis and mitigation

CVE-2025-61780 is an information disclosure vulnerability in the Rack::Sendfile middleware of the Rack Ruby web server interface. When running behind a proxy that supports x-sendfile headers (such as Nginx), specially crafted client-supplied x-sendfile-type or x-accel-mapping headers could cause the middleware to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions. The vulnerability affects Rack versions prior to 2.2.20, 3.0.x–3.1.x prior to 3.1.18, and 3.2.x prior to 3.2.3. It was published on October 10, 2025, with patches released the same day. The CVSS v3.1 base score is 5.8 (Moderate) per the GitHub Advisory, or 5.3 (Medium) per NVD (Github Advisory, Rack Security Advisory).

The root cause is improper trust of client-controlled HTTP headers in Rack::Sendfile (CWE-200, CWE-441 — Confused Deputy, CWE-913). Prior to the fix, the variation method in lib/rack/sendfile.rb would read the HTTP_X_SENDFILE_TYPE header directly from the incoming request and use it to determine the sendfile mechanism, allowing an attacker to activate x-accel-redirect mode without any server-side configuration. Similarly, the HTTP_X_ACCEL_MAPPING header was consumed unconditionally, enabling an attacker to control path mapping. By sending x-sendfile-type: x-accel-redirect and a crafted x-accel-mapping header, an attacker could cause Rack to issue a redirect response that the Nginx proxy would follow as an internal subrequest — one not subject to the proxy's normal access controls. Exploitation requires: (1) the application uses Rack::Sendfile with a proxy supporting x-accel-redirect; (2) the proxy does not always set or strip these headers; and (3) the application exposes an endpoint whose response body responds to .to_path (Github Advisory, Rack Commit 57277b7).

Successful exploitation allows an unauthenticated remote attacker to bypass proxy-enforced access restrictions and access internal application endpoints that are intended to be protected, such as administrative pages. The vulnerability does not permit arbitrary file reads or code execution, and integrity and availability are not affected. The primary risk is confidentiality loss through exposure of sensitive application routes that should be inaccessible from the public internet (Github Advisory, Rack Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.011–0.03%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been identified (Github Advisory, Rack Security Advisory).

1. Reconnaissance: Identify web applications running Rack (e.g., Ruby on Rails apps) behind an Nginx reverse proxy that uses x-accel-redirect. Look for server headers or framework indicators suggesting Rack usage.
2. Identify a qualifying endpoint: Find an application endpoint that returns a response body implementing .to_path (e.g., file download endpoints served via Rack::Files).
3. Craft malicious headers: Prepare an HTTP request with the following headers:
   • x-sendfile-type: x-accel-redirect (to activate the vulnerable sendfile mode)
   • x-accel-mapping: /var/www/=/admin/ (to remap internal paths to a protected route)
4. Send the request: Issue the crafted HTTP GET request to the qualifying endpoint on the target application.
5. Proxy reissues internal request: Rack's Sendfile middleware interprets the attacker-supplied headers as proxy configuration, responds with a redirect that instructs Nginx to issue an internal subrequest to the mapped path — bypassing Nginx access controls.
6. Access protected content: The Nginx proxy fetches and returns the content of the internal endpoint (e.g., an admin page) that would otherwise be blocked (Github Advisory, Rack Security Advisory).

• Network: Inbound HTTP requests containing both x-sendfile-type: x-accel-redirect and x-accel-mapping headers originating from untrusted clients (not the proxy itself); unexpected internal Nginx subrequests to administrative or restricted paths.
• Logs: Web server access logs showing requests to file-serving endpoints with unusual x-sendfile-type or x-accel-mapping headers; Nginx error or access logs showing internal subrequests (X-Accel-Redirect) to paths not normally accessed directly.
• Application Logs: Rack middleware logs reflecting x-accel-redirect activation without corresponding server-side configuration; responses to file endpoints that should not trigger sendfile behavior.

Upgrade Rack to a patched version: 2.2.20, 3.1.18, or 3.2.3, released October 10, 2025. The fix requires explicit middleware configuration to enable x-accel-redirect (use Rack::Sendfile, "x-accel-redirect") and ignores the HTTP_X_SENDFILE_TYPE header from client requests entirely. As a proxy-level workaround, configure Nginx to always set or strip these headers before passing requests to the backend:

proxy_set_header x-sendfile-type x-accel-redirect;
proxy_set_header x-accel-mapping /var/www/=/files/;

For Rails applications, sendfile can be disabled entirely with config.action_dispatch.x_sendfile_header = nil. Upgrading to a patched Rack version is the recommended primary remediation (Github Advisory, Rack Security Advisory).

The vulnerability was credited to researchers leahneukirchen (analyst) and jeremyevans (analyst), with ioquatix as the remediation developer and matthewd as the remediation reviewer. The advisory was published directly by the Rack maintainers via GitHub Security Advisories on October 10, 2025. Downstream Linux distributions including Debian, Ubuntu, Fedora, SUSE, and Mageia subsequently issued security updates for their packaged versions of ruby-rack. Chef Infra Server also released updates (versions 15.10.83 and 15.10.91) incorporating the patched Rack gem (Rack Security Advisory).