4 results · Feed
-
Critical 9.9
Remote Code Execution Vulnerability in Session Storage
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store. If one's appl…
-
High 7.0
Cached redirect poisoning via X-Forwarded-Host header
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` head…
-
Medium 6.1
Default development error handler in Ratpack is vulnerable to HTML content injection (XSS)
All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects the development mode error handler when an exception message contains untrusted data. Note the production mode error hand…
-
High 7.5CVE-2019-17513 Public exploit
io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Resp…