Ruby URI Gem Credential Leakage Vulnerability Bypass

A vulnerability exists in the Ruby URI gem, specifically in versions prior to 0.12.5, 0.13.0 through 0.13.2, and 1.0.0 through 1.0.3. This vulnerability bypasses a previous fix for CVE-2025-27221, allowing for the unintentional exposure of user credentials. When the '+' operator is used to merge URIs, sensitive data such as passwords can be leaked from the original URI, in violation of RFC3986. This behavior creates a risk of credential exposure in applications.

Impact

Exploitation of this vulnerability can lead to unauthorized leakage of user credentials, including passwords, from URIs.

Reproduction

To reproduce this vulnerability, use a version of the Ruby URI gem that is affected, such as 0.13.2. Create a URI that includes sensitive information, such as a password, in the userinfo component. Then, use the '+' operator to merge this URI with another. The resulting URI will violate RFC3986 by leaking the sensitive information, thereby exposing the credentials.

Remediation

Users are advised to upgrade to URI gem versions 0.12.5, 0.13.3, or 1.0.4 and later.