Improper Validation of Syntactic Correctness of Input in Rack - #VU159497
Published: November 5, 2026
Vulnerability details
The vulnerability allows remote attackers to inject invalid authority values into application-generated absolute URLs and redirects, bypass string-based URL or origin checks, and reflect markup when applications do not escape the value. Applications are exposed when they use Rack's req.url, req.base_url, or req.host_with_port without enforcing a host allowlist. Generated links and Location headers can be redirected through userinfo tricks.
The vulnerability exists due to Rack::Request#host_with_port falling back to the original, unvalidated authority when split_authority fails to match the AUTHORITY pattern and returns no components. A remote attacker can supply an invalid Host, or an attacker-controlled X-Forwarded-Host or Forwarded: host= value accepted by the deployment, to embed characters such as @, /, ?, #, spaces, or angle brackets verbatim in generated URLs. Forwarded headers take priority by default, so an invalid forwarded host can trigger the behavior even when Host is valid. The base_url method combines the scheme with host_with_port, and url appends the full path, propagating the invalid value through both methods.
For example, Host: evil.com/@legit.com causes host to return nil while host_with_port returns evil.com/@legit.com and base_url returns http://evil.com/@legit.com. Sinatra's redirect can emit the raw invalid authority in a Location header when a proxy forwards attacker-controlled X-Forwarded-Host. Rails overrides these methods in Action Dispatch and is not expected to be affected.