Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-27221

CVE-2025-27221: URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

3.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-27221
GHSA ID
GHSA-22h5-pq3x-2gf2
EPSS Score
0.03044%
CWE
CWE-200
Published
3/3/2025
Updated
3/4/2025
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
urirubygems< 0.11.30.11.3
urirubygems>= 0.12.0, < 0.12.40.12.4
urirubygems>= 0.13.0, < 0.13.20.13.2
urirubygems>= 1.0.0, < 1.0.31.0.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly identifies URI#join, URI#merge, and URI#+ as the affected methods. These are instance methods of the URI::Generic class in Ruby's URI gem, as confirmed by:

  1. The CVE's technical details describing host replacement without userinfo removal
  2. The linked GitHub pull requests (e.g., ruby/uri#154) showing fixes applied to URI::Generic's merge/join logic
  3. Ruby's URI module structure, where URI manipulation methods are defined in URI::Generic
  4. The CWE-212 mapping (improper data removal) aligning with the failure to clear userinfo during URI operations

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T**r* is * possi*ility *or us*rin*o l**k*** *y in t** uri **m. T*is vuln*r**ility **s ***n *ssi*n** t** *V* i**nti*i*r *V*-****-*****. W* r**omm*n* up*r**in* t** uri **m. ## **t*ils T** m*t*o*s `URI#join`, `URI#m*r**`, *n* `URI#+` r*t*in** us*rin*o

Reasoning

T** vuln*r**ility **s*ription *xpli*itly i**nti*i*s URI#join, URI#m*r**, *n* URI#+ *s t** *****t** m*t*o*s. T**s* *r* inst*n** m*t*o*s o* t** URI::**n*ri* *l*ss in Ru*y's URI **m, *s *on*irm** *y: *. T** *V*'s t***ni**l **t*ils **s*ri*in* *ost r*pl*