URI Gem Userinfo Leakage Vulnerability in Ruby

A vulnerability in the URI gem for Ruby, affecting versions prior to 1.0.3, has been identified. The issue arises in the URI handling methods URI.join, URI#merge, and URI#+, where authentication credentials are inadvertently leaked. This occurs because userinfo is retained even after the host is changed. When a URL containing sensitive userinfo is merged with a malicious host, and the resulting URL is accessed, the userinfo can be unintentionally exposed.

Impact

Exploitation of this vulnerability can lead to the unintentional leakage of authentication credentials, such as user names and passwords.

Reproduction

To reproduce this vulnerability, use the URI gem version prior to 1.0.3. Apply the URI#join, URI#merge, or URI#+ methods to a URL that includes userinfo (e.g., a URL with embedded credentials like user:password). Replace the host with a malicious one. When the modified URL is accessed, the userinfo will be leaked.

Remediation

Users are advised to upgrade the URI gem to version 0.11.3, 0.12.4, 0.13.2, or 1.0.3 and later.