CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has ruby packages installed that are affected by multiple vulnerabilities:

  - CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary     HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
    (CVE-2008-5189)

  - Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6     before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems,     allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus),     (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to     the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot     option. (CVE-2008-1891)

  - Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly     restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers     to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash     table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2     algorithm, a different vulnerability than CVE-2011-4815. (CVE-2012-5371)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has ruby packages installed that are affected by multiple vulnerabilities:

  - CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary     HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
    (CVE-2008-5189)

  - Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6     before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems,     allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus),     (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to     the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot     option. (CVE-2008-1891)

  - Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly     restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers     to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash     table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2     algorithm, a different vulnerability than CVE-2011-4815. (CVE-2012-5371)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary
    HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
    (CVE-2008-5189)

Missing input sanitation in rubygem-actionpack allowed remote attackers to inject arbitrary HTTP headers via specially crafted URLs (CVE-2008-5189).

CVE-2008-5189: CGI header injection vulnerability

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote server is running the Ruby on Rails web application.
This version of Rails is reported to be vulnerable to a flaw in the way that it handles user-supplied input to the 'redirect_to()' function in the 'ActionController::Base' class.  An attacker exploiting this flaw would be able to inject arbitrary HTTP headers that could lead to cross-site request forgery (CSRF), cross-site scripting (XSS) and other attacks.

ID	Name	Product	Family	Severity
301218	NewStart CGSL MAIN 6.06 (SP) : ruby Multiple Vulnerabilities (NS-SA-2026-0023)	Nessus	NewStart CGSL Local Security Checks	medium
266226	NewStart CGSL MAIN 6.06 : ruby Multiple Vulnerabilities (NS-SA-2025-0208)	Nessus	NewStart CGSL Local Security Checks	medium
422273	SCA: security update for rails (GHSA-jmgf-p46x-982h)	Tenable Cloud Security	SCA Checks	medium
422273	SCA: security update for rails (GHSA-jmgf-p46x-982h)	Tenable Self-Hosted Container Security	SCA Checks	medium
40123	openSUSE Security Update : rubygem-actionpack (rubygem-actionpack-327)	Nessus	SuSE Local Security Checks	medium
36945	Fedora 10 : rubygem-actionpack-2.1.1-2.fc10 (2009-2149)	Nessus	Fedora Local Security Checks	medium
35753	Fedora 9 : rubygem-actionpack-2.1.1-2.fc9 (2009-2179)	Nessus	Fedora Local Security Checks	medium
34987	openSUSE 10 Security Update : rubygem-actionpack (rubygem-actionpack-5816)	Nessus	SuSE Local Security Checks	medium
4764	Ruby on Rails < 2.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2008-5189

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium