CVE-2023-22792

Vulnerability

CVE-2023-22792 is a regular expression denial-of-service (ReDoS) vulnerability in the Action Dispatch component of Ruby on Rails [1]. The flaw lies in the way Action Dispatch processes HTTP Cookie headers in combination with the X_FORWARDED_HOST header. When an attacker sends a specially crafted cookie value along with a malicious X_FORWARDED_HOST header, the regular expression engine enters a state of catastrophic backtracking [1]. This regex behavior causes the CPU and memory usage to spike, leading to a denial of service condition [1].

Attack

Vector and Prerequisites

The attack is exploitable remotely without authentication [1]. An attacker only needs to send a single HTTP request containing both a crafted cookie and a crafted X_FORWARDED_HOST header to a vulnerable Rails application [1]. No special network position is required; the attack can be delivered over the internet. The vulnerability is triggered during request processing, before any controller logic executes, meaning the application does not need to be in a specific state to be affected.

Impact

Successful exploitation results in high CPU and memory consumption on the target server, effectively causing a denial of service [1]. This can render the Rails application unresponsive to legitimate traffic, potentially affecting all users of the service. The impact is limited to availability; there is no evidence of data corruption or information disclosure from this vulnerability.

Mitigation

The vulnerability is fixed in Rails versions 6.0.6.1, 6.1.7.1, and 7.0.4.1 [3]. Users running any older version within the 6.0.x, 6.1.x, or 7.0.x series should upgrade immediately [3]. For those unable to upgrade, the official advisory recommends using a workaround, such as applying a monkey-patch or using a reverse proxy to sanitize the X_FORWARDED_HOST header [1][3].