Detections
Analytics
SCA: security update for rack (GHSA-r657-rxjc-j557)
medium Tenable Self-Hosted Container Security Plugin ID 435564
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible
information disclosure vulnerability existed in `Rack::Sendfile` when running behind a proxy that supports
`x-sendfile` headers (such as Nginx). Specially crafted headers could cause `Rack::Sendfile` to
miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level
access restrictions. When `Rack::Sendfile` received untrusted `x-sendfile-type` or `x-accel-mapping`
headers from a client, it would interpret them as proxy configuration directives. This could cause the
middleware to send a "redirect" response to the proxy, prompting it to reissue a new internal request that
was not subject to the proxy's access controls. An attacker could exploit this by setting a crafted
`x-sendfile-type: x-accel-redirect` header, setting a crafted `x-accel-mapping` header, and requesting a
path that qualifies for proxy-based acceleration. Attackers could bypass proxy-enforced restrictions and
access internal endpoints intended to be protected (such as administrative pages). The vulnerability did
not allow arbitrary file reads but could expose sensitive application routes. This issue only affected
systems meeting all of the following conditions: The application used `Rack::Sendfile` with a proxy that
supports `x-accel-redirect` (e.g., Nginx); the proxy did **not** always set or remove the `x-sendfile-
type` and `x-accel-mapping` headers; and the application exposed an endpoint that returned a body
responding to `.to_path`. Users should upgrade to Rack versions 2.2.20, 3.1.18, or 3.2.3, which require
explicit configuration to enable `x-accel-redirect`. Alternatively, configure the proxy to always set or
strip the header, or in Rails applications, disable sendfile completely. (CVE-2025-61780)
See Also
Plugin Details
Severity: Medium
ID: 435564
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 10/10/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2025-61780
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/10/2025
Vulnerability Publication Date: 10/10/2025
Reference Information
CVE: CVE-2025-61780