Miggo Logo
Miggo Vulnerability Database
→
CVE-2015-7519

CVE-2015-7519: Phusion Passenger allows remote attackers to spoof headers

3.7

CVSS Score
3.0

Basic Information

CVE ID
CVE-2015-7519
GHSA ID
GHSA-fxwv-953p-7qpf
EPSS Score
0.56002%
CWE
CWE-20
Published
10/10/2018
Updated
7/5/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
passengerrubygems< 4.0.604.0.60
passengerrubygems>= 5.0.0, < 5.0.225.0.22

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper input validation in header processing. The commit diff shows the addition of 'containsNonAlphaNumDash' to filter invalid headers, which was missing in vulnerable versions. The pre-patch code in constructHeaderForSessionProtocol only checked for specific headers (content-type, content-length, connection) but didn't validate header name characters. This allowed underscore-containing headers to pass through, enabling spoofing via SCGI's case conversion. The function's role in header construction and the explicit patch targeting this code path confirm its vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

`***nt/*or*/*ontroll*r/S*n*R*qu*st.*pp` in P*usion P*ss*n**r ***or* *.*.** *n* *.*.x ***or* *.*.**, w**n us** in *p**** int**r*tion mo** or in st*n**lon* mo** wit*out * *ilt*rin* proxy, *llows r*mot* *tt**k*rs to spoo* *****rs p*ss** to *ppli**tions

Reasoning

T** vuln*r**ility st*ms *rom improp*r input v*li**tion in *****r pro**ssin*. T** *ommit *i** s*ows t** ***ition o* '*ont*insNon*lp**Num**s*' to *ilt*r inv*li* *****rs, w*i** w*s missin* in vuln*r**l* v*rsions. T** pr*-p*t** *o** in `*onstru*t*****r*o