Cached redirect poisoning via X-Forwarded-Host header

Vulnerability

Ratpack versions prior to 1.9.0 are vulnerable to cache poisoning when an HTTP cache is placed in front of the server and the cache key does not include the X-Forwarded-Host header. By default, Ratpack uses an inferring PublicAddress implementation that derives the server's address from the request context, including the X-Forwarded-Host header. This allows an attacker to supply a malicious X-Forwarded-Host value to influence the server's redirect responses. Users who have configured a custom PublicAddress instance via ServerConfigBuilder::publicAddress are not affected [1][2][3].

Exploitation

An attacker must be able to send HTTP requests to a Ratpack application that is fronted by a cache that does not key on the X-Forwarded-Host header. The attacker sends a request with a crafted X-Forwarded-Host header pointing to an attacker-controlled domain. If the application issues a redirect (e.g., after a login or post request), the server's default PublicAddress will use the attacker-supplied host to construct the redirect URL. The cache stores this malicious redirect response. Subsequent requests from other users will receive the cached redirect, sending them to the attacker's site [1][2][3].

Impact

Successful exploitation results in redirect cache poisoning. An attacker can force cached redirect responses to direct users to a malicious website, enabling phishing, malware distribution, or other attacks that rely on the user trusting the redirect source. The attack does not require authentication or special privileges; only network access to the Ratpack server is needed [1][2][3].

Mitigation

The vulnerability is patched in Ratpack version 1.9.0, released on June 29, 2021. The fix includes two changes: the default PublicAddress no longer infers the address from the request context, and relative redirects are no longer absolutized (they are passed through as-is). Users unable to upgrade should configure a custom PublicAddress using ServerConfigBuilder::publicAddress to explicitly set the server's public address in production [2][3]. This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.