Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| websocket-driver | rubygems | < 0.8.2 | 0.8.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the websocket-driver library for Ruby, specifically within the HTTP request parsing logic. The provided patch commit 7d6fd87759a2fdc83590d3b49ffa661dc53fa128 clearly indicates the vulnerable code. The file lib/websocket/http/request.rb was modified. Before the patch, the complete method directly parsed the Host header from the request. If a client sent a request with a malformed Host header, the URI.parse("http://#{ host }") call would raise a URI::InvalidURIError. The complete method did not have a rescue block to handle this specific error, causing the exception to propagate up the stack and crash the server application if it was not handled at a higher level. The patch fixed this by moving the parsing logic to a new set_server_vars method and wrapping the URI.parse call within a rescue URI::InvalidURIError block. Therefore, the WebSocket::Http::Request.complete method is the function that contained the vulnerable code.
WebSocket::Http::Request.completelib/websocket/http/request.rb