Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-30123

CVE-2022-30123:
Possible shell escape sequence injection vulnerability in Rack

10

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-30123
GHSA ID
GHSA-wq4h-7r42-5hrr
EPSS Score
0.83931%
CWE
CWE-150
Published
5/27/2022
Updated
12/17/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
rackrubygems<= 2.0.9.02.0.9.1
rackrubygems>= 2.1, <= 2.1.4.02.1.4.1
rackrubygems>= 2.2, <= 2.2.3.02.2.3.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The GitHub commit diff shows critical changes in these two components:

  1. In CommonLogger, a gsub! was added to escape non-printable characters in log messages
  2. In Lint, .dump was added to sanitize REQUEST_METHOD values in error messages These changes directly address CWE-150 (escape sequence injection) by adding proper sanitization where user-controlled data (HTTP method) was being output to logs/errors. The vulnerability description explicitly names these middleware components as the attack vectors.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T**r* is * possi*l* s**ll *s**p* s*qu*n** inj**tion vuln*r**ility in t** Lint *n* *ommonLo***r *ompon*nts o* R**k. T*is vuln*r**ility **s ***n *ssi*n** t** *V* i**nti*i*r *V*-****-*****. V*rsions *****t**: *ll. Not *****t**: Non* *ix** V*rsi

Reasoning

T** *it*u* *ommit *i** s*ows *riti**l ***n**s in t**s* two *ompon*nts: *. In *ommonLo***r, * *su*! w*s ***** to *s**p* non-print**l* ***r**t*rs in lo* m*ss***s *. In Lint, .*ump w*s ***** to s*nitiz* R*QU*ST_M*T*O* v*lu*s in *rror m*ss***s T**s* ***n