Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in the Faraday library, caused by an incomplete fix for a previous vulnerability. The root cause lies in the Faraday::Connection#build_exclusive_url function, which did not correctly handle request URLs passed as Ruby URI objects. When a user provides a protocol-relative URL (e.g., //attacker.com/path) as a URI object instead of a String, the library failed to treat it as a relative path. Consequently, instead of joining the path with the pre-configured base URL's host, Faraday would resolve the host from the provided URI object, redirecting the request to an attacker-controlled server. This allowed sensitive, connection-scoped headers (like Authorization) to be leaked.
The patch addresses this by explicitly converting any URI-like object to its string representation (url.to_s if url.respond_to?(:host)) within build_exclusive_url. This ensures that the URL is processed by the subsequent string-based logic, which correctly identifies and sanitizes protocol-relative URLs by prepending ./. This forces the URL to be treated as a relative path, thus preventing the host override. The analysis of the patch commit 3f1280c69e93297d574e85a2d462d05ebadf1d09 confirms this change and identifies build_exclusive_url as the core vulnerable function, with run_request, Request#url, and Request#to_env being part of the vulnerable call chain.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| faraday | rubygems | >= 2.0.0, <= 2.14.1 | 2.14.2 |
