CyberRota Analysis
AI-GeneratedPuma web server versions 5.5.0 through 7.2.1 and 8.0.2 are vulnerable to source IP spoofing when the proxy_protocol: :v1 setting is enabled and persistent connections are utilized. This vulnerability allows attackers to inject a second PROXY header, potentially overwriting the REMOTE_ADDR variable and leading to unauthorized access or misattribution of user actions. Organizations using affected Puma versions, particularly those relying on proxy configurations, should prioritize upgrading to versions 7.2.1 or 8.0.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.