Puma Source IP Spoofing Vulnerability via PROXY Protocol v1 on Persistent Connections

A vulnerability in Puma, a Ruby/Rack web server, allows for source IP spoofing when PROXY protocol v1 is enabled and persistent connections are used. This issue affects Puma versions 5.5.0 prior to 7.2.1 and 8.0.2. The vulnerability arises because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection. An attacker could inject a second PROXY header, overwriting the REMOTE_ADDR variable. This misconfiguration can lead to security issues, as applications may rely on REMOTE_ADDR for security decisions, rate limiting, or auditing.

Impact

Exploitation of this vulnerability can mislead applications or middleware that use the REMOTE_ADDR variable for security decisions, rate limiting, auditing, or managing allow/deny lists.

Reproduction

To reproduce this vulnerability, deploy Puma with PROXY protocol v1 parsing enabled and use persistent connections. An attacker can then send HTTP requests through a trusted proxy, injecting a second PROXY header that Puma will incorrectly prioritize, allowing the attacker to spoof the source IP address.

Remediation

Users should upgrade to Puma versions 7.2.1 or 8.0.2. If PROXY protocol v1 is not needed, it can be disabled by removing or commenting out the 'set_remote_address proxy_protocol: :v1' line in the configuration. Alternatively, users can disable persistent connections to Puma.