rubygem-rack: Local File Inclusion in Rack::Static
CVE: CVE-2025-27610
Component: rack
CWE: CWE-23
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-03-10T22:19:25.982000+00:00

A flaw was found in RackRubygems, where Rack::Static does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. This flaw allows an attacker to gain access to all files under the specified root directory, provided they can determine the file's path.

Statement: This is an Important vulnerability because it allows attackers to bypass `urls:` restrictions and access unintended files under the `root:` directory using encoded path traversal. Since `Rack::Static` is often used to serve public assets, any sensitive files within the same root—like credentials, configs, or source code—can be exposed. The flaw breaks expected isolation between public and private files, and since it’s exploitable remotely without authentication, the impact is far more severe than a moderate issue.

PCS does not use Rack::StaticHandler to serve files; static files are served by Tornado.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/updating_red_hat_satellite/index
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes/ocp-4-13-release-notes

For Red Hat OpenShift Logging 5.8, see the following instructions to apply this update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/logging/cluster-logging-upgrading
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/ocp-4-14-release-notes

For Red Hat OpenShift Logging 5.9, see the following instructions to apply this update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/logging/cluster-logging-upgrading
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.