Description
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sinatra sinatra
>= 3.0, < 3.0.4affected>= 2.0, < 2.2.3affected
References
- https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw ↗
- https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b ↗
- https://github.com/advisories/GHSA-8x94-hmjh-97hq ↗
- https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf ↗
- https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html ↗
- https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html ↗